hxxps://play[.]pokemonshowdown[.]com/audio/cries/

Resubmissions

24/02/2024, 19:26

240224-x5p1jscd26 1

24/02/2024, 19:25

240224-x47h7scc84 1

Analysis

max time kernel
1168s
max time network
1172s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
24/02/2024, 19:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://play.pokemonshowdown.com/audio/cries/

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	1248	firefox.exe
Token: SeDebugPrivilege	1248	firefox.exe
Token: SeDebugPrivilege	1248	firefox.exe
Token: SeDebugPrivilege	1248	firefox.exe
Token: SeDebugPrivilege	1248	firefox.exe
Token: SeDebugPrivilege	1248	firefox.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1248	firefox.exe
1248	firefox.exe
1248	firefox.exe
1248	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1248	firefox.exe
1248	firefox.exe
1248	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1248	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 1248	2168	firefox.exe	45
PID 2168 wrote to memory of 1248	2168	firefox.exe	45
PID 2168 wrote to memory of 1248	2168	firefox.exe	45
PID 2168 wrote to memory of 1248	2168	firefox.exe	45
PID 2168 wrote to memory of 1248	2168	firefox.exe	45
PID 2168 wrote to memory of 1248	2168	firefox.exe	45
PID 2168 wrote to memory of 1248	2168	firefox.exe	45
PID 2168 wrote to memory of 1248	2168	firefox.exe	45
PID 2168 wrote to memory of 1248	2168	firefox.exe	45
PID 2168 wrote to memory of 1248	2168	firefox.exe	45
PID 2168 wrote to memory of 1248	2168	firefox.exe	45
PID 1248 wrote to memory of 2500	1248	firefox.exe	89
PID 1248 wrote to memory of 2500	1248	firefox.exe	89
PID 1248 wrote to memory of 2036	1248	firefox.exe	90
PID 1248 wrote to memory of 2036	1248	firefox.exe	90
PID 1248 wrote to memory of 2036	1248	firefox.exe	90
PID 1248 wrote to memory of 2036	1248	firefox.exe	90
PID 1248 wrote to memory of 2036	1248	firefox.exe	90
PID 1248 wrote to memory of 2036	1248	firefox.exe	90
PID 1248 wrote to memory of 2036	1248	firefox.exe	90
PID 1248 wrote to memory of 2036	1248	firefox.exe	90
PID 1248 wrote to memory of 2036	1248	firefox.exe	90
PID 1248 wrote to memory of 2036	1248	firefox.exe	90
PID 1248 wrote to memory of 2036	1248	firefox.exe	90
PID 1248 wrote to memory of 2036	1248	firefox.exe	90
PID 1248 wrote to memory of 2036	1248	firefox.exe	90
PID 1248 wrote to memory of 2036	1248	firefox.exe	90
PID 1248 wrote to memory of 2036	1248	firefox.exe	90
PID 1248 wrote to memory of 2036	1248	firefox.exe	90
PID 1248 wrote to memory of 2036	1248	firefox.exe	90
PID 1248 wrote to memory of 2036	1248	firefox.exe	90
PID 1248 wrote to memory of 2036	1248	firefox.exe	90
PID 1248 wrote to memory of 2036	1248	firefox.exe	90
PID 1248 wrote to memory of 2036	1248	firefox.exe	90
PID 1248 wrote to memory of 2036	1248	firefox.exe	90
PID 1248 wrote to memory of 2036	1248	firefox.exe	90
PID 1248 wrote to memory of 2036	1248	firefox.exe	90
PID 1248 wrote to memory of 2036	1248	firefox.exe	90
PID 1248 wrote to memory of 2036	1248	firefox.exe	90
PID 1248 wrote to memory of 2036	1248	firefox.exe	90
PID 1248 wrote to memory of 2036	1248	firefox.exe	90
PID 1248 wrote to memory of 2036	1248	firefox.exe	90
PID 1248 wrote to memory of 2036	1248	firefox.exe	90
PID 1248 wrote to memory of 2036	1248	firefox.exe	90
PID 1248 wrote to memory of 2036	1248	firefox.exe	90
PID 1248 wrote to memory of 2036	1248	firefox.exe	90
PID 1248 wrote to memory of 2036	1248	firefox.exe	90
PID 1248 wrote to memory of 2036	1248	firefox.exe	90
PID 1248 wrote to memory of 2036	1248	firefox.exe	90
PID 1248 wrote to memory of 2036	1248	firefox.exe	90
PID 1248 wrote to memory of 2036	1248	firefox.exe	90
PID 1248 wrote to memory of 2036	1248	firefox.exe	90
PID 1248 wrote to memory of 2036	1248	firefox.exe	90
PID 1248 wrote to memory of 2036	1248	firefox.exe	90
PID 1248 wrote to memory of 2036	1248	firefox.exe	90
PID 1248 wrote to memory of 2036	1248	firefox.exe	90
PID 1248 wrote to memory of 2036	1248	firefox.exe	90
PID 1248 wrote to memory of 2036	1248	firefox.exe	90
PID 1248 wrote to memory of 2036	1248	firefox.exe	90
PID 1248 wrote to memory of 2036	1248	firefox.exe	90
PID 1248 wrote to memory of 2036	1248	firefox.exe	90
PID 1248 wrote to memory of 2408	1248	firefox.exe	91
PID 1248 wrote to memory of 2408	1248	firefox.exe	91
PID 1248 wrote to memory of 2408	1248	firefox.exe	91

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://play.pokemonshowdown.com/audio/cries/"
1⤵
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://play.pokemonshowdown.com/audio/cries/
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1248
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1248.0.1417951929\1995382043" -parentBuildID 20221007134813 -prefsHandle 1896 -prefMapHandle 1888 -prefsLen 20750 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {370c664d-20f7-421b-8714-9672a02533f7} 1248 "\\.\pipe\gecko-crash-server-pipe.1248" 1988 23e65cbe858 gpu
    3⤵
    PID:2500
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1248.1.1984557573\1286135371" -parentBuildID 20221007134813 -prefsHandle 2392 -prefMapHandle 2388 -prefsLen 21566 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {44dd3650-0599-4ad9-afa9-fc2d8e479312} 1248 "\\.\pipe\gecko-crash-server-pipe.1248" 2416 23e65bfc058 socket
    3⤵
    PID:2036
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1248.2.1319903076\1837033077" -childID 1 -isForBrowser -prefsHandle 2868 -prefMapHandle 3164 -prefsLen 21714 -prefMapSize 233444 -jsInitHandle 1172 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {877bc8e0-098b-4c16-be62-5d468d1e98e9} 1248 "\\.\pipe\gecko-crash-server-pipe.1248" 3240 23e65c5fc58 tab
    3⤵
    PID:2408
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1248.3.674725575\985575395" -childID 2 -isForBrowser -prefsHandle 3656 -prefMapHandle 3652 -prefsLen 26112 -prefMapSize 233444 -jsInitHandle 1172 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a6893044-21c7-4c8c-aed1-6a4c0b9b5bf6} 1248 "\\.\pipe\gecko-crash-server-pipe.1248" 3664 23e59463558 tab
    3⤵
    PID:1756
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1248.5.1254922471\800165164" -childID 4 -isForBrowser -prefsHandle 5104 -prefMapHandle 5108 -prefsLen 26171 -prefMapSize 233444 -jsInitHandle 1172 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d31b0183-59be-4388-9907-e21c110e1f25} 1248 "\\.\pipe\gecko-crash-server-pipe.1248" 5100 23e6c80e258 tab
    3⤵
    PID:2428
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1248.6.214725922\1811191245" -childID 5 -isForBrowser -prefsHandle 5368 -prefMapHandle 4692 -prefsLen 26171 -prefMapSize 233444 -jsInitHandle 1172 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1ea5dd69-8248-41e4-8b9d-4b2fdfa6f1c3} 1248 "\\.\pipe\gecko-crash-server-pipe.1248" 5292 23e6c8f6558 tab
    3⤵
    PID:2636
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1248.4.1330813671\176904719" -childID 3 -isForBrowser -prefsHandle 4960 -prefMapHandle 4872 -prefsLen 26171 -prefMapSize 233444 -jsInitHandle 1172 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e05301d8-6241-405a-a9ee-a0d76c7b5a26} 1248 "\\.\pipe\gecko-crash-server-pipe.1248" 4968 23e6c80c458 tab
    3⤵
    PID:4508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\viagl6cs.default-release\cache2\entries\4832D199584363B876D3E7D57CA02A9B0F4D91CD

Filesize
13KB

MD5
3e37eb1dcd686e4b4106b1f9a15c4dd3

SHA1
dfb798e2bda47711c5b3526616f7a6c08e25d3c7

SHA256
47215f1bf372cc70016fc49104765736b737decaa7a93d6a90eec7942543872b

SHA512
91bb4495cc7e0a525cb02eaa4af42d8571f561be330fb04a01e60af35314a57036cc34eaf0a5bf5cb4ac61dcb3a6a408ef6b213b4b8e6316c446415060be2104

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\viagl6cs.default-release\cache2\entries\E66F5AA5E3C285C270CF84BD11111C74D38F245C

Filesize
13KB

MD5
d28969e0e531993e3f23496209f811b7

SHA1
5622f05681a295f390903676944df9b8062bd519

SHA256
83b68c01daa8419fb69abc10551e9345a6512b3037417f935599719bb51d9a59

SHA512
b7a9991d5b0026bb52f2331d38b029e5ab23d96b0dd7af9c9ce0431ed163a6ff683a5045e01ee63426205109bbf92fe8abc48fe3b416bff8c806101e1313af36

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
8.0MB

MD5
a01c5ecd6108350ae23d2cddf0e77c17

SHA1
c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

SHA256
345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

SHA512
b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
7KB

MD5
cabe23427357be539001bfd9dfa54e06

SHA1
31b1b3023f1ec27d251355139160a924d5dff624

SHA256
7690779f6f3f38da66d7359e577acf81dadf2878c12441ddf219f3172190e3af

SHA512
2602d3b9c02171a03e09a3a053b42056e236c41ccaf47d0e154862004325d5135a88fdf1457fe650fee36981876cdb768ee22ac224a148590aebfde8d5af924f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\viagl6cs.default-release\addonStartup.json.lz4

Filesize
5KB

MD5
fcb087b787dcbb45f6af26e80fd6d5a4

SHA1
80ccf50f89e9cedc6d0dd1a31eaa93ed5664bf95

SHA256
19ac0e6df5765917228c1b15d0a5a2062b20a508ff0a90da22bd040db4706238

SHA512
89b36b920397d4d09488066970d33faa83d1ba3403c7ffe77850087605bd064733b25d4bcb796e5b06f248506b9afe7e2745d0e81095424a1140c98ef851267d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\viagl6cs.default-release\bookmarkbackups\bookmarks-2024-02-24_11_sD46Ck0gjrqxdZU1rrP3ug==.jsonlz4

Filesize
945B

MD5
4b22b64f1880e8d7fee4423fa1488829

SHA1
fb74e5f2aeb7dd59dffd347de0f9891018d758ea

SHA256
031de3cfb076aefc577874d2c2e468b7dd7a65008c2a8b35ef379511a0b2e04b

SHA512
87b80725e2bb5dd9acd417adf3e8525e05087e9c46d99fe0b1f7acbd68312b32b2e5d1015c45166d15cb8bea559dddeac47985e70714349eb228024eed2cba42

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\viagl6cs.default-release\broadcast-listeners.json

Filesize
216B

MD5
7ba34f0550300a79b93108a1dc65efbd

SHA1
d7af7d1f2d466f804591771d58da35e5d41bc626

SHA256
04ed4df2245de6704cb18a855f8a6ace34212c720824f60e9986aae67e461273

SHA512
1e3cd19885b224ea7f827533c9b30428df0e3026ffe1abab2ace2f3e750f7ba6c20182f9b2a3adff9f6cf309c7e349f628f7873c7a94f2112b32b210c5ee97ca

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\viagl6cs.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
96f60ddb0b9ab294d6cf52247bb01fbb

SHA1
b9914a7cb7d53cac865bbdce93470bafbfe7ae22

SHA256
f7ba01477aff21e6d302e7be7ced236899f1f4e69286aa7c7f2c87776438b661

SHA512
30cdbb43baf5a4039168b56f5d589f11b65b19473eeafe3a7e7c6ee1618ff4c72a3faeb6c5a14247384609e2f56e02b2e9698f7728173b65466ad259e32f8af0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\viagl6cs.default-release\datareporting\glean\pending_pings\39a56537-b268-48bf-8b60-e1f61c3f3feb

Filesize
746B

MD5
13970ff3543b78fb489656a0c24eadee

SHA1
58043ad62b17d8cfc61aef386a17196048fcc0b9

SHA256
e5b12360952b7317788e500f33bd06e177a6e57bea6d7b029cdcc02ad266e652

SHA512
3b9754aa3a03383bc5a8d02db83a2c00fdf111b6a75d9a9096d2af7e42622c58dc1b33c2471eace23e187c1f8c4edc65672a957fd252efc8b07150091a34c087

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\viagl6cs.default-release\datareporting\glean\pending_pings\9d496ca7-ccdf-4d15-9646-8c235f9a76d1

Filesize
11KB

MD5
12058eed14e03eacbc49b24a0112084f

SHA1
44a55661bf8c4c9e551cda4b433751153b427ff5

SHA256
6c10372910a515671ca14114ab88d5e05c64bab63a5c56d88f56c4b4a7a362fa

SHA512
c2c213d86695a3fe99892284103d6a59b73231fa39975f59d5cc561ad71f2ceab28e9da4d2a1a376dd2ddd8ad0bcf9e704162275417703250f3ae6edd436bab2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\viagl6cs.default-release\extensions.json.tmp

Filesize
34KB

MD5
627014f202a2adc73e2079bf54af2e41

SHA1
c11efb3119da10cf76dae6023a2b6491301f1e02

SHA256
f7e374c01c30489d08dc7631fe2498077dc652d3a4b43f769b7dfc73ecfcbe5b

SHA512
643b9fa9a34a426ded52117e98977c76aed2c6ba23dc7b1d3afb096116301bbee30bb09b18a92ac497f6e74c6b552aa5e7a6534cba57608a5121169f0c3a2b3e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\viagl6cs.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\viagl6cs.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\viagl6cs.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\viagl6cs.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\viagl6cs.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

Filesize
11.8MB

MD5
33bf7b0439480effb9fb212efce87b13

SHA1
cee50f2745edc6dc291887b6075ca64d716f495a

SHA256
8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

SHA512
d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\viagl6cs.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\viagl6cs.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\viagl6cs.default-release\prefs-1.js

Filesize
10KB

MD5
8755e3fec4bca91438585d7036d409a9

SHA1
181bf4cd5436b08851de55873023a7e14538181b

SHA256
f09f94ad81adf96a5966c095f956dd365f814a5fa1a1b019604707bc6c4b07e5

SHA512
d5e48acb8558be0554e1907939932379297aa93ddeab18b5f2fe36b20d2e4a9db82aa04715465f574e52e0f29f6f4689dc0bc583c1b7d3c1fa76725b64fbb849

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\viagl6cs.default-release\prefs-1.js

Filesize
9KB

MD5
13e5cc382561eea9cbfc862a7d26730f

SHA1
3864ad5da7182e6a7dbed99f4914864cf39be5e5

SHA256
11002d8cfbd82019f7073ccfedd2a80d0ce759e804283f4bc0d97324d42ffaa1

SHA512
d9ea8dcf695fe5f5944024b980601a1b86bc1a597d7ebf49533f593227491b948e001dba0f712946ebb358033f8c86f9d70f4e07bffa429eff622a346751d234

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\viagl6cs.default-release\prefs-1.js

Filesize
10KB

MD5
134972e773602f0bed87e97fe1c2989e

SHA1
2c9ba0e27571429822acccb7a31bf327cedc1c80

SHA256
ba9b799170b04748e6ff16e48b59d76bd04b20b5da65283804bc28d2cf1f55b4

SHA512
227dafb99a05f1fa1557f3343d744116905d9dbaeb6385a45ef606f40fb21316eddd0e4965e554f3ccbafbb418e485fb4bc532b7ce3535069b7b9d43c7d973fa

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\viagl6cs.default-release\prefs.js

Filesize
6KB

MD5
bc1fe3d06749ba91cf8776bfd341b9ff

SHA1
653669ca13190c54bc8b7c7a19659fae271a8f30

SHA256
0f30c04853a157e99250e9fc1a9650ad14de6d0644b45a24492e75f1cf0642d4

SHA512
e540deb197763d2149dc40a203a7e44559cd8d521b614dfd89386071da8e31e485cd1a1479cbda229bd81d3d236f5467bb62e3e95daccc84cf38529b3aa09c5a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\viagl6cs.default-release\prefs.js

Filesize
10KB

MD5
adc5b161cee30e18a0f656d73ce24dfc

SHA1
aeecb7c39664e1c31daa6ce9d0942ece45451488

SHA256
96b5255b0d29fa30724b187c76dbbd4f5a416e5f0ba76ddd617fd9cff5bec3f1

SHA512
449478f903e82e7fac63aeb80f01eec0a6b69c4ebe8478151e269a52944aeb75a71f03a556a7590a20cde7e35798559cd88c681f021a60c37738297e43ac81e1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\viagl6cs.default-release\prefs.js

Filesize
7KB

MD5
60a68ddf3cb12d57c5c0c527a0373a68

SHA1
2bf0aeadc27c9aa3365510a95e0f356b55ebd3f8

SHA256
3c1bcb24fdb99ab0dda6a07f67a991684e10c1efd3280c84d7f24501da48aeed

SHA512
705b3798cf3a56dfe9e9d965a9f9abba22e153c28007161f3b7e0d223aa036819225def4665f7c933c2c4ac011a097958b36e568fe4f08b5eb0e571f7f1a0103

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\viagl6cs.default-release\prefs.js

Filesize
6KB

MD5
5f16073f108864311838b6589ca46e68

SHA1
78dc19fabf18010a6e0bcd965c13b2997854843c

SHA256
6c71450231ee79aab1fc1397538b13db879761572eadd81749acd256aa1168b7

SHA512
6ea7d09713f67b96349fbbd73a414b06d80b61fd61fbbbf7f6096c63209abd296bf010b1782e5747ba391a9b7240e1e4d7ac92a2b4e9c5c8f21a7254b148e9d4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\viagl6cs.default-release\sessionCheckpoints.json

Filesize
90B

MD5
c4ab2ee59ca41b6d6a6ea911f35bdc00

SHA1
5942cd6505fc8a9daba403b082067e1cdefdfbc4

SHA256
00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2

SHA512
71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\viagl6cs.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
52KB

MD5
3e3735861a02aaf9c594aef92774216e

SHA1
a8b3352b35106793e0752c0c1c28f755db378d96

SHA256
6464b903cadb06cf293ac5e865bfc3dff152960edcb1587a8f0c03e747265516

SHA512
456c08f1420ad20bcf1b993ad9649cf7ae1d63d0c77753e612ef89160a287d100ec439f8ea096b5650ae6e40cc53153334defc24fefb27fa42123beb45768623

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\viagl6cs.default-release\targeting.snapshot.json

Filesize
3KB

MD5
e5011cec9553a793f0d9084fe6519aa5

SHA1
854668da48fd7e195e63da646fa4104d2c8f3b1c

SHA256
7b93cda387e501a51f560cae21f91a8386a11c4350a471f666a699bf1cb72c7e

SHA512
f70a0648b51ed262d8ced9424298e2a0aacb3cf00a82da6cd780cb653795f957222172b3ffd4d126c2d96cb68bc7d2f0d95cd668f14aef89b424ed3597d87146

Download Submit