Malware Analysis Report

2024-11-30 04:45

Sample ID 240223-ff7evsbb8y
Target https://download2351.mediafire.com/sm24pq2ja12gIkr6ANd8hBZBtzNvbL86ofmt2oH2-Bca2Feuo9B9ty1_sfgZfevMA1tlE5DrWc1TLEWTIT4ghzJoNjJO3vIASD0VQxrX7iOjjrAveXppvuFUucQHB2mrHV6vE1_NlpqF1tcHIJW6ezMSRaYF2bp3xnk-iYG0fez5/wl9moebaudqauqv/ROBLOX+Cheat.zip
Tags
score
1/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
1/10

Threat Level: No (potentially) malicious behavior was detected

The file https://download2351.mediafire.com/sm24pq2ja12gIkr6ANd8hBZBtzNvbL86ofmt2oH2-Bca2Feuo9B9ty1_sfgZfevMA1tlE5DrWc1TLEWTIT4ghzJoNjJO3vIASD0VQxrX7iOjjrAveXppvuFUucQHB2mrHV6vE1_NlpqF1tcHIJW6ezMSRaYF2bp3xnk-iYG0fez5/wl9moebaudqauqv/ROBLOX+Cheat.zip was found to be: No (potentially) malicious behavior was detected.

Malicious Activity Summary


Modifies registry class

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Uses Task Scheduler COM API

Checks processor information in registry

NTFS ADS

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-02-23 04:49

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-02-23 04:49

Reported

2024-02-23 04:52

Platform

win11-20240221-en

Max time kernel

100s

Max time network

102s

Command Line

"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://download2351.mediafire.com/sm24pq2ja12gIkr6ANd8hBZBtzNvbL86ofmt2oH2-Bca2Feuo9B9ty1_sfgZfevMA1tlE5DrWc1TLEWTIT4ghzJoNjJO3vIASD0VQxrX7iOjjrAveXppvuFUucQHB2mrHV6vE1_NlpqF1tcHIJW6ezMSRaYF2bp3xnk-iYG0fez5/wl9moebaudqauqv/ROBLOX+Cheat.zip

Signatures

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Program Files\Mozilla Firefox\firefox.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings C:\Program Files\Mozilla Firefox\firefox.exe N/A

NTFS ADS

Description Indicator Process Target
File created C:\Users\Admin\Downloads\ROBLOX Cheat.zip:Zone.Identifier C:\Program Files\Mozilla Firefox\firefox.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1188 wrote to memory of 4996 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1188 wrote to memory of 4996 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1188 wrote to memory of 4996 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1188 wrote to memory of 4996 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1188 wrote to memory of 4996 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1188 wrote to memory of 4996 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1188 wrote to memory of 4996 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1188 wrote to memory of 4996 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1188 wrote to memory of 4996 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1188 wrote to memory of 4996 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1188 wrote to memory of 4996 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4996 wrote to memory of 4544 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4996 wrote to memory of 4544 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4996 wrote to memory of 2992 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4996 wrote to memory of 2992 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4996 wrote to memory of 2992 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4996 wrote to memory of 2992 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4996 wrote to memory of 2992 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4996 wrote to memory of 2992 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4996 wrote to memory of 2992 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4996 wrote to memory of 2992 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4996 wrote to memory of 2992 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4996 wrote to memory of 2992 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4996 wrote to memory of 2992 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4996 wrote to memory of 2992 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4996 wrote to memory of 2992 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4996 wrote to memory of 2992 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4996 wrote to memory of 2992 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4996 wrote to memory of 2992 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4996 wrote to memory of 2992 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4996 wrote to memory of 2992 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4996 wrote to memory of 2992 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4996 wrote to memory of 2992 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4996 wrote to memory of 2992 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4996 wrote to memory of 2992 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4996 wrote to memory of 2992 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4996 wrote to memory of 2992 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4996 wrote to memory of 2992 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4996 wrote to memory of 2992 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4996 wrote to memory of 2992 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4996 wrote to memory of 2992 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4996 wrote to memory of 2992 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4996 wrote to memory of 2992 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4996 wrote to memory of 2992 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4996 wrote to memory of 2992 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4996 wrote to memory of 2992 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4996 wrote to memory of 2992 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4996 wrote to memory of 2992 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4996 wrote to memory of 2992 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4996 wrote to memory of 2992 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4996 wrote to memory of 2992 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4996 wrote to memory of 2992 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4996 wrote to memory of 2992 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4996 wrote to memory of 2992 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4996 wrote to memory of 2992 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4996 wrote to memory of 2992 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4996 wrote to memory of 2992 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4996 wrote to memory of 2992 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4996 wrote to memory of 2992 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4996 wrote to memory of 2992 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4996 wrote to memory of 2992 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4996 wrote to memory of 2216 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4996 wrote to memory of 2216 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4996 wrote to memory of 2216 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://download2351.mediafire.com/sm24pq2ja12gIkr6ANd8hBZBtzNvbL86ofmt2oH2-Bca2Feuo9B9ty1_sfgZfevMA1tlE5DrWc1TLEWTIT4ghzJoNjJO3vIASD0VQxrX7iOjjrAveXppvuFUucQHB2mrHV6vE1_NlpqF1tcHIJW6ezMSRaYF2bp3xnk-iYG0fez5/wl9moebaudqauqv/ROBLOX+Cheat.zip

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://download2351.mediafire.com/sm24pq2ja12gIkr6ANd8hBZBtzNvbL86ofmt2oH2-Bca2Feuo9B9ty1_sfgZfevMA1tlE5DrWc1TLEWTIT4ghzJoNjJO3vIASD0VQxrX7iOjjrAveXppvuFUucQHB2mrHV6vE1_NlpqF1tcHIJW6ezMSRaYF2bp3xnk-iYG0fez5/wl9moebaudqauqv/ROBLOX+Cheat.zip"

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4996.0.1827900478\1908468593" -parentBuildID 20221007134813 -prefsHandle 1808 -prefMapHandle 1800 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d0dd617e-6d5e-45bb-88bd-9e280d49434c} 4996 "\\.\pipe\gecko-crash-server-pipe.4996" 1888 1d39b6d7358 gpu

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4996.1.1349283526\1359493283" -parentBuildID 20221007134813 -prefsHandle 2272 -prefMapHandle 2268 -prefsLen 21563 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {57eabe61-cf11-4961-aae2-971cdbb036a2} 4996 "\\.\pipe\gecko-crash-server-pipe.4996" 2284 1d38f5eba58 socket

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4996.2.915349385\1911674475" -childID 1 -isForBrowser -prefsHandle 2792 -prefMapHandle 3032 -prefsLen 21666 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c9c26f60-6303-4c9a-a22a-4b95b7556f5b} 4996 "\\.\pipe\gecko-crash-server-pipe.4996" 3008 1d3a05dd058 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4996.3.1896124697\1242188647" -childID 2 -isForBrowser -prefsHandle 3508 -prefMapHandle 3504 -prefsLen 26064 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9663ca00-3557-4ce4-baa5-aaaa12275e79} 4996 "\\.\pipe\gecko-crash-server-pipe.4996" 3516 1d38f569d58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4996.6.1811446038\513835019" -childID 5 -isForBrowser -prefsHandle 4696 -prefMapHandle 4764 -prefsLen 26123 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f1074793-10c9-47c4-a559-c4f38679b6ee} 4996 "\\.\pipe\gecko-crash-server-pipe.4996" 4672 1d3a2b4ce58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4996.5.1393753194\651435392" -childID 4 -isForBrowser -prefsHandle 4988 -prefMapHandle 4992 -prefsLen 26123 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2b5abf70-faf0-40f1-a05d-11af13333567} 4996 "\\.\pipe\gecko-crash-server-pipe.4996" 4980 1d3a2b4c858 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4996.4.2023277965\258460962" -childID 3 -isForBrowser -prefsHandle 4832 -prefMapHandle 4636 -prefsLen 26123 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {33e5ee81-c5b9-4b05-a551-fdadc916727f} 4996 "\\.\pipe\gecko-crash-server-pipe.4996" 4844 1d3a2892158 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4996.7.2106139063\1780332405" -childID 6 -isForBrowser -prefsHandle 2760 -prefMapHandle 2880 -prefsLen 26379 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7766d88a-1a2c-4c93-8c53-1ccb783745e5} 4996 "\\.\pipe\gecko-crash-server-pipe.4996" 7992 1d38f508158 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4996.8.1949516908\186658312" -childID 7 -isForBrowser -prefsHandle 7772 -prefMapHandle 7776 -prefsLen 26379 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {16290539-9c3b-4230-ab51-1142f64e905e} 4996 "\\.\pipe\gecko-crash-server-pipe.4996" 3432 1d3a0be6858 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4996.10.1171201389\2023854430" -childID 9 -isForBrowser -prefsHandle 7664 -prefMapHandle 3376 -prefsLen 26379 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d23fae83-302d-4473-a423-5bf724dcb790} 4996 "\\.\pipe\gecko-crash-server-pipe.4996" 7672 1d3a0be7458 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4996.9.42058178\997822648" -childID 8 -isForBrowser -prefsHandle 7812 -prefMapHandle 7796 -prefsLen 26379 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {37230ebf-58a8-44e8-be58-7c193b82cf83} 4996 "\\.\pipe\gecko-crash-server-pipe.4996" 7820 1d3a0be8c58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4996.12.1495280231\1777803938" -childID 11 -isForBrowser -prefsHandle 9356 -prefMapHandle 9352 -prefsLen 26379 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {14676114-da12-473e-a889-cc56a9967306} 4996 "\\.\pipe\gecko-crash-server-pipe.4996" 9364 1d3a496d358 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4996.11.2076789805\558275251" -childID 10 -isForBrowser -prefsHandle 9496 -prefMapHandle 9500 -prefsLen 26379 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c76ea22e-2d98-4310-826d-fac81cced57e} 4996 "\\.\pipe\gecko-crash-server-pipe.4996" 9488 1d3a48c1c58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4996.13.2064640496\1758408549" -childID 12 -isForBrowser -prefsHandle 9184 -prefMapHandle 9380 -prefsLen 26379 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {599c6334-3091-460f-9183-23107a5c6179} 4996 "\\.\pipe\gecko-crash-server-pipe.4996" 9056 1d3a4540258 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4996.14.581698748\1070915324" -childID 13 -isForBrowser -prefsHandle 8816 -prefMapHandle 8820 -prefsLen 26379 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fece001b-d7bf-4f1a-a162-3bb3af9163f9} 4996 "\\.\pipe\gecko-crash-server-pipe.4996" 8812 1d3a5151558 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4996.15.1363997707\2109832247" -childID 14 -isForBrowser -prefsHandle 8600 -prefMapHandle 8536 -prefsLen 26379 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {296271bc-2054-4422-a590-e240578bf8b8} 4996 "\\.\pipe\gecko-crash-server-pipe.4996" 8516 1d3a497b558 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4996.16.2043775052\2010004395" -childID 15 -isForBrowser -prefsHandle 9248 -prefMapHandle 9192 -prefsLen 26379 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7c046fcd-6bdc-4ebc-bb50-1098a6c4e3c5} 4996 "\\.\pipe\gecko-crash-server-pipe.4996" 9256 1d3a6837458 tab

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4996.17.964287167\432436189" -childID 16 -isForBrowser -prefsHandle 8028 -prefMapHandle 1560 -prefsLen 26684 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {32d91c9a-e0f5-41b9-bf3e-259366bd13dc} 4996 "\\.\pipe\gecko-crash-server-pipe.4996" 8040 1d3a2bb9f58 tab

Network

Country Destination Domain Proto
N/A 127.0.0.1:49735 tcp
US 8.8.8.8:53 contile.services.mozilla.com udp
US 8.8.8.8:53 download2351.mediafire.com udp
US 8.8.8.8:53 content-signature-2.cdn.mozilla.net udp
US 8.8.8.8:53 shavar.services.mozilla.com udp
US 199.91.155.92:443 download2351.mediafire.com tcp
US 34.117.237.239:443 contile.services.mozilla.com tcp
US 34.160.144.191:443 content-signature-2.cdn.mozilla.net tcp
US 8.8.8.8:53 prod.content-signature-chains.prod.webservices.mozgcp.net udp
US 52.24.144.241:443 shavar.prod.mozaws.net tcp
US 34.107.243.93:443 autopush.prod.mozaws.net tcp
US 34.149.100.209:443 prod.remote-settings.prod.webservices.mozgcp.net tcp
US 104.16.114.74:443 static.mediafire.com tcp
US 8.8.8.8:53 static.cloudflareinsights.com udp
US 34.149.100.209:443 prod.remote-settings.prod.webservices.mozgcp.net tcp
GB 172.217.16.228:443 www.google.com tcp
US 104.16.114.74:443 static.mediafire.com tcp
US 104.16.114.74:443 static.mediafire.com tcp
US 104.16.114.74:443 static.mediafire.com tcp
US 104.16.57.101:443 static.cloudflareinsights.com tcp
GB 142.250.200.42:443 translate-pa.googleapis.com tcp
GB 142.250.200.42:443 translate-pa.googleapis.com udp
GB 172.217.16.228:443 www.google.com udp
US 8.8.8.8:53 232.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 3.180.250.142.in-addr.arpa udp
GB 142.250.200.10:443 translate-pa.googleapis.com tcp
GB 18.172.155.200:443 cdn.amplitude.com tcp
GB 142.250.200.10:443 translate-pa.googleapis.com udp
US 34.212.72.103:443 api.amplitude.com tcp
GB 172.217.169.42:443 translate-pa.googleapis.com tcp
GB 172.217.169.42:443 translate-pa.googleapis.com udp
US 8.8.8.8:53 173.178.17.96.in-addr.arpa udp
US 216.239.32.36:443 region1.analytics.google.com tcp
GB 216.58.204.67:443 www.google.co.uk tcp
US 216.239.32.36:443 region1.analytics.google.com udp
GB 216.58.204.67:443 www.google.co.uk udp
N/A 127.0.0.1:49741 tcp
BE 142.251.173.156:443 stats.g.doubleclick.net tcp
BE 142.251.173.156:443 stats.g.doubleclick.net udp
US 172.67.199.186:443 privacy.gatekeeperconsent.com tcp
US 104.22.75.216:443 btloader.com tcp
US 172.64.193.22:443 www.ezojs.com.cdn.cloudflare.net tcp
US 172.67.199.186:443 privacy.gatekeeperconsent.com udp
US 172.64.193.22:443 www.ezojs.com.cdn.cloudflare.net udp
US 104.21.42.32:443 privacy.gatekeeperconsent.com tcp
US 104.19.215.37:443 otnolatrnup.com tcp
FR 13.39.145.251:443 g.ezoic.net tcp
US 104.26.3.70:443 ad-delivery.net tcp
US 104.26.3.70:443 ad-delivery.net tcp
US 104.21.42.32:443 privacy.gatekeeperconsent.com udp
US 130.211.23.194:443 api.btloader.com tcp
US 104.19.215.37:443 otnolatrnup.com udp
US 104.21.42.32:443 privacy.gatekeeperconsent.com tcp
US 172.64.193.4:443 go.ezodn.com tcp
US 172.64.193.4:443 go.ezodn.com tcp
US 172.64.193.4:443 go.ezodn.com tcp
US 104.19.215.37:443 otnolatrnup.com tcp
US 8.8.8.8:53 otnolatrnup.com udp
US 8.8.8.8:53 securepubads.g.doubleclick.net udp
US 130.211.23.194:443 api.btloader.com udp
US 172.64.193.4:443 go.ezodn.com udp
US 104.19.215.37:443 otnolatrnup.com udp
GB 172.217.169.34:443 securepubads.g.doubleclick.net tcp
DE 3.77.97.150:443 tlx.3lift.com tcp
US 34.120.63.153:443 prebid.media.net tcp
DE 18.197.85.154:443 btlr.sharethrough.com tcp
DE 18.197.85.154:443 btlr.sharethrough.com tcp
DE 18.197.85.154:443 btlr.sharethrough.com tcp
DE 18.197.85.154:443 btlr.sharethrough.com tcp
DE 18.197.85.154:443 btlr.sharethrough.com tcp
GB 185.64.190.77:443 hbopenbid.pubmatic.com tcp
IE 54.77.245.72:443 bcp.crwdcntrl.net tcp
GB 18.165.201.65:443 tags.crwdcntrl.net tcp
IE 54.77.245.72:443 bcp.crwdcntrl.net tcp
US 130.211.23.194:443 api.btloader.com udp
GB 172.217.169.34:443 securepubads.g.doubleclick.net udp
US 34.120.63.153:443 prebid.media.net udp
GB 96.16.109.9:443 e6603.g.akamaiedge.net tcp
US 13.248.245.213:443 eu-eb2.3lift.com tcp
GB 92.123.240.21:443 contextual.media.net tcp
GB 92.123.240.21:443 contextual.media.net udp
NL 198.47.127.19:443 image6.pubmatic.com tcp
NL 198.47.127.19:443 image6.pubmatic.com tcp
US 34.102.146.192:443 oa.openxcdn.net tcp
GB 18.245.247.167:443 d2avimlm6gq3h9.cloudfront.net tcp
US 151.101.1.229:443 cdn.jsdelivr.net tcp
GB 216.58.204.65:443 pagead-googlehosted.l.google.com tcp
US 34.102.146.192:443 oa.openxcdn.net udp
US 151.101.1.229:443 cdn.jsdelivr.net udp
GB 216.58.204.65:443 pagead-googlehosted.l.google.com udp
GB 142.250.187.193:443 cdn-content.ampproject.org tcp
GB 142.250.187.193:443 cdn-content.ampproject.org tcp
GB 142.250.187.193:443 cdn-content.ampproject.org tcp
GB 142.250.187.193:443 cdn-content.ampproject.org tcp
GB 142.250.187.193:443 cdn-content.ampproject.org tcp
GB 142.250.187.193:443 cdn-content.ampproject.org tcp
US 104.22.53.86:443 cdn.id5-sync.com tcp
NL 178.250.1.3:443 static.criteo.net tcp
US 34.96.70.87:443 invstatic101.creativecdn.com tcp
US 172.64.152.89:443 cdn-ima.33across.com.cdn.cloudflare.net tcp
US 34.120.107.143:443 oajs.openx.net tcp
GB 216.58.212.193:443 tpc.googlesyndication.com tcp
GB 142.250.187.193:443 cdn-content.ampproject.org udp
GB 216.58.212.193:443 tpc.googlesyndication.com udp
US 34.96.70.87:443 invstatic101.creativecdn.com udp
US 34.120.107.143:443 oajs.openx.net udp
DE 162.19.138.82:443 id5-sync.com tcp
US 35.244.159.8:443 google-bidout-d.openx.net tcp
US 35.244.159.8:443 google-bidout-d.openx.net udp
GB 142.250.178.2:443 googleads.g.doubleclick.net tcp
US 8.8.8.8:53 82.138.19.162.in-addr.arpa udp
US 8.8.8.8:53 8.159.244.35.in-addr.arpa udp
US 8.8.8.8:53 226.212.58.216.in-addr.arpa udp
GB 142.250.178.2:443 googleads.g.doubleclick.net udp
NL 178.250.1.11:443 gum.nl3.vip.prod.criteo.com tcp
FR 178.250.7.13:443 dnacdn.net tcp
FR 185.235.86.60:443 gbc2.fr3.eu.criteo.com tcp
NL 185.235.87.107:443 gbc3.nl3.eu.criteo.com tcp
US 104.19.215.37:443 otnolatrnup.com tcp
US 199.91.155.12:443 download2271.mediafire.com tcp
US 104.19.215.37:443 otnolatrnup.com udp
US 104.19.215.37:80 otnolatrnup.com tcp
GB 18.165.227.8:443 woreppercomming.com tcp
US 104.21.96.72:443 www.ovardu.com tcp
US 104.21.96.72:443 www.ovardu.com udp
DE 3.127.11.50:443 front-geo.production.opera-website.route53.opera.com tcp
GB 216.58.213.14:443 www.googleoptimize.com tcp
GB 104.84.85.174:443 e11604.dscf.akamaiedge.net tcp
GB 104.84.85.174:443 e11604.dscf.akamaiedge.net tcp
GB 104.84.85.174:443 e11604.dscf.akamaiedge.net tcp
GB 104.84.85.174:443 e11604.dscf.akamaiedge.net tcp
GB 104.84.85.174:443 e11604.dscf.akamaiedge.net tcp
GB 104.84.85.174:443 e11604.dscf.akamaiedge.net tcp
GB 216.58.213.14:443 www.googleoptimize.com udp
US 151.101.1.140:443 reddit.map.fastly.net tcp
US 216.239.32.36:443 region1.analytics.google.com tcp
GB 216.58.204.67:443 www.google.co.uk tcp
US 151.101.1.140:443 reddit.map.fastly.net tcp
US 216.239.32.36:443 region1.analytics.google.com udp
GB 216.58.204.67:443 www.google.co.uk udp
BE 142.251.173.156:443 stats.g.doubleclick.net tcp
GB 13.224.245.27:443 static-cdn.hotjar.com tcp
GB 88.221.134.88:443 a1916.dscg2.akamai.net tcp
GB 163.70.147.23:443 scontent.xx.fbcdn.net tcp
GB 89.187.167.8:443 tags.creativecdn.com tcp
US 151.101.1.140:443 reddit.map.fastly.net tcp
BE 142.251.173.156:443 stats.g.doubleclick.net udp
GB 89.187.167.8:443 tags.creativecdn.com udp
GB 163.70.147.23:443 scontent.xx.fbcdn.net udp
NL 185.184.8.90:443 ams.creativecdn.com tcp
NL 185.184.8.90:443 ams.creativecdn.com tcp
GB 18.245.253.22:443 script.hotjar.com tcp
US 13.107.42.14:443 l-0005.l-msedge.net tcp
GB 157.240.214.35:443 www.facebook.com tcp
GB 172.217.16.228:443 www.google.com tcp
GB 157.240.214.35:443 www.facebook.com udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
GB 172.217.169.34:443 securepubads.g.doubleclick.net udp
GB 163.70.151.35:443 www.facebook.com tcp
GB 163.70.151.35:443 www.facebook.com udp
GB 142.250.187.193:443 cdn-content.ampproject.org udp
GB 216.58.204.67:443 www.google.co.uk udp
US 216.239.32.36:443 region1.analytics.google.com udp
GB 172.217.16.228:443 www.google.com udp
GB 142.250.178.2:443 googleads.g.doubleclick.net udp

Files

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\d8xutbrp.default-release\datareporting\glean\db\data.safe.bin

MD5 ee2c43b3464a2d6364bda74b7366ea05
SHA1 e54a04cc5764af588a83655d65f6d8480c5ccb34
SHA256 9492116d255807cadeacfa7640ca53a1c180bf65c5f578e6f455947154019a31
SHA512 e5b4723270c2bc6c5c941d0971e9f5a964613afea8657c4cb102e09ea4418e38b28245a09d26a05769fff4c35aaed060ed5993b7ef87cf7b839948f1c7a86f14

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\d8xutbrp.default-release\datareporting\glean\pending_pings\f9dfa539-f2d6-4de7-ade4-a8aedb3e1a88

MD5 8ed8e3e5c3be89f538933838691cc23f
SHA1 bae3de5ec42b73c67e3bb32069283e34c779db12
SHA256 81bd74b4b90ceebf377681507cc11989793f5e5cb253dc4aaa755cedb791156c
SHA512 4f4045337f85c81939fa61447560ce1e3e508cd961c5a4577adc4c7299bfbb293986cc4e41943a87291a61661cf7688152fc9b08811fa74bb47c9ac668fbdb35

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\d8xutbrp.default-release\datareporting\glean\pending_pings\83a17ebb-b697-4008-a392-e4cbfc3a96ca

MD5 e22ac9e646b70856813d0e83d17668ff
SHA1 54bbed3b21c58544b1a78cda69805956bc333a08
SHA256 37e0d15461e315d50eb324aae2237d5e4103a011d7bb2beb999f31e44d0df432
SHA512 2fc438fdf65ff4880c6bcb4c6fe0699d869fbaf95132daa69a66b3f7bb65b001310d16ee23c084cac97a6651e29c0eb28247f27259093bacafd1a11c782d520c

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\d8xutbrp.default-release\prefs-1.js

MD5 2089e5d564f1d14f6295d4079c95cec6
SHA1 390c93ea90b00341ec75cd15f4c55c83b4bc9e43
SHA256 3b6510beee6dca2809752ccecec386d4156e5e1fd3e55cea4a45f44ee551f37e
SHA512 7184528dbe7d5c986c2ecc4fc7a81f1b0edc2a66103e05aad9aa2e7a4af00afb2993a1380907b7fc0a158e6fcee2bd2fd3e1fa2fadfc666e58fcb00f0a5bb9ff

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\d8xutbrp.default-release\cache2\doomed\13876

MD5 5d20f15e75947c0f8034669827850fbc
SHA1 077af40a643d0206a149de65c212f94ed2ea3690
SHA256 adf030a188ed1ca441ad6e7eb676bf648fc8de336b79411c79fe1c7fd849d32e
SHA512 bb093dda1c96808922b77e84d1ecf9373ecafeec219ef178fa69ee1620f1586eba42ad91705e6e8d504100b02015b97e9a1043808309a0b2490f13e9152b9451

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\d8xutbrp.default-release\cache2\doomed\29704

MD5 2e9b10108a53c27587e1d053480b45ef
SHA1 aa8343868ca248c59851456eae95e6a9a22c13f2
SHA256 5d2e0a04ca945b8e47ffa5e343f9a91f45c80abc4c44a687dc0100433f7199b3
SHA512 96647b7725128019bb51b7d831c6ea049aad5289a0cdf970bb290446346b34c6fa2c1f1f2960f4e794f47bbff1053aaa23e3500b2e212d8147887d01b294d959

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\d8xutbrp.default-release\sessionstore-backups\recovery.jsonlz4

MD5 3045b8f933cdffeacec4aeb5cf15d302
SHA1 aec5431b1139b23ad948ad0cf47b486701487416
SHA256 a25bac8b4ce73e37c16b7fe4a72aa365e914da91465bf3707c35d28cb9e456a9
SHA512 b9687a58ee4804d0ab80420a01914e6e5c8427141f324dbfcb3dcf0666e02850496ba60dc70589d585908101511f6a93e4345842b741f80c63309b788eafd8dd

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\d8xutbrp.default-release\cache2\entries\98F1291D54F57F525B77C2B47E39CAB697984D45

MD5 f263c55dd2bac9352b23c60d1c22a073
SHA1 ab557e32fb90ae0e3aec210646b09794e578aa90
SHA256 aa7c4aeeeae0f90f9302c674ae7095a5fc25f8aa39cb24d50e89459f2cd7769d
SHA512 2c06e096c1f2cb97ebb178bcd6d1a0e4ab8db622d919648564499ae56d6a5b58f7977f8888ce29eede54f4f9274b7ed30cb4cf36a5709c9ff0151e98a289ce5e

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\d8xutbrp.default-release\cache2\entries\9967D86AF2672726E170B9608B147BC13B602691

MD5 101f13dd280df46360d76b8863ae806d
SHA1 c5768c08037d0b72df80de11ef15129d5379b766
SHA256 9fffaa04928c02bab8f4b0e5f5e703eefd3a73fcce84bbe25b5fa5df0e87c0c5
SHA512 add4d967622f581db30af4ee9441a80e68b9700afb7af3186f2c6eeca2cf82b2ee722cfd5cbc81973052b380c1d852ff4416e90b88835c9816768e12fe52f209

C:\Users\Admin\Downloads\ROBLOX Cheat.1v1xuhaD.zip.part

MD5 aef8e50be606dd200d36017edc8943f7
SHA1 9846d3ba37601394cfc441fbeabef7bf6992c981
SHA256 44e1936241d14390f002898d36deaa38bc88bc5280030d803d908afbf1ac7bb5
SHA512 9269e1c96e8f8b15330f08029137c49f6dc6958cc778ca99eca546c77f5ca022c1755296d292b8edd33a56e0e9d39a1f83cebde4f94a8cd5a32f816a950f6aa6

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\d8xutbrp.default-release\prefs-1.js

MD5 0bdf3dfe00a228494dd4ae426a783266
SHA1 22a3007f59184cc9e28941068045c3cda89341c2
SHA256 e0795a4cf6c2d24b4e26c4f475645afc949fabcd254e94da8aa1b52eb8ae49e0
SHA512 fea0e1498f185aa5e441477bdd347262a8787b61926c89beab1a81330c3405dc4bf12686e737d5a0c7ba0a27eed1fb452c3b13909b54ba15e1fb3b3ce8b6b2ca

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\d8xutbrp.default-release\sessionstore-backups\recovery.jsonlz4

MD5 1f8c92b874456ca7ddbbc801084d1da7
SHA1 181410c071be6d7851749887e2a4dc0925c6fcc7
SHA256 0386c4bb0310cdd9e31e1e557422f10924012ff75b0c9cd96d5b1275e646973d
SHA512 f6ac036845dcc24e5a1164908c50cf914f75cd6da441ec4cf98536010b23d7b6569d661efedcdaceaa75e81fb61f0b4df96c8f2e9fe377b749ed23c61ac73aca

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\d8xutbrp.default-release\sessionstore-backups\recovery.jsonlz4

MD5 ea2fb7b67b5d3bf3eee15266a25b0760
SHA1 ef34a498e8932c7ae916337d14c7fadc65b8d77e
SHA256 16d34e05087a0125dc4f2dd5f5ac12d38c73a52fd1573eb772a1fe739a99d04e
SHA512 cb4b24f3fc5955e002ef6a3be44e1bcacd4564779d9f6f788a34eabd24768f0f05ce611333f030060de78a82f53cf16b62e912130f8f139703436ef0057e4157

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\d8xutbrp.default-release\cache2\doomed\14182

MD5 de85be0c45e251529718100b146dbc4b
SHA1 6a4f0f225cae259feff8fcdeb4b4e01ec9a382e4
SHA256 25580896b5f4b26c4d379c3fb23851a7f5368b333a0211694f56618d46b89ee4
SHA512 fb189592405f35c775717a5567778753a3affdc2f2d03e5c8b41c3138936ab6e23925f6eda107400426fe2fb793811f4aa2558f3f9c62953c08b503b0380a237

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\d8xutbrp.default-release\cache2\doomed\447

MD5 95f5aeed244842a012f16956b86f9cd2
SHA1 fff80a6be702dbca5df7b925289cef663a125a48
SHA256 2b5d53529fe7afd7c4ce71ae3eaf96b5d66b5f5872cc0f4363930fabfae349da
SHA512 5900ca616765052afc0e0448d450a0c56eedd7120a92b5210f7a80300a38fbe834b3b41d001c83e2f0e545420ae94e5c16e642f25f9866b87910838ccc9ef008