5bb5c2c3dd3e7c527e3e2d08acbdd849b732bffb5c0352e5513236987c644516

Analysis

user interaction
yes
max time kernel
264s
max time network
264s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
23/04/2026, 02:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Gravethorn.exe
Size 234KB
Sample260423-dafnvahs3w
SHA256 5bb5c2c3dd3e7c527e3e2d08acbdd849b732bffb5c0352e5513236987c644516
MD5 75f72cc3acdba3cc4cfdf3cb4307e022
SHA1 dac807246eacc521fbbd007b7fa9a7e73b48d26a
SHA512 4565a22051628e96423ec64cf631d5a4f625376085688696970281e31eb889aacd326dfc6b0e374b285fafb52cbbef90d66e17abcca7fb39262792acb7d0bee4
SSDEEP 3072:K3rTYT6Xyfd+ux9IfBqsmx/LpHQvLq/Zr9CS55GPjlgyE20zLhoIu7jn8Sd5hE:2YT6E0cmYsmr4UelgyEzb
TLSH
T1AE3418657640E19FD023D73274A1E67253A13C60F6A4AE5B7AB463136EF31C0EE29BC1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery persistence

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
96	3240	firefox.exe

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
84	api.gofile.io
134	api.gofile.io
169	api.gofile.io
13	api.gofile.io

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 2 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\Downloads\OperaGXSetup.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\OperaGXSetup(1).exe:Zone.Identifier	firefox.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 64 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings	firefox.exe

NTFS ADS 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\OperaGXSetup.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\OperaGXSetup(1).exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\Gravethorn.Build.22790733.zip:Zone.Identifier	firefox.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	3240	firefox.exe
Token: SeDebugPrivilege	3240	firefox.exe
Token: SeDebugPrivilege	3240	firefox.exe
Token: SeDebugPrivilege	3240	firefox.exe
Token: SeDebugPrivilege	3240	firefox.exe
Token: SeDebugPrivilege	3240	firefox.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3240	firefox.exe
3240	firefox.exe
3240	firefox.exe
3240	firefox.exe
3240	firefox.exe
3240	firefox.exe
3240	firefox.exe
3240	firefox.exe
3240	firefox.exe
3240	firefox.exe
3240	firefox.exe
3240	firefox.exe
3240	firefox.exe
3240	firefox.exe
3240	firefox.exe
3240	firefox.exe
3240	firefox.exe
3240	firefox.exe
3240	firefox.exe
3240	firefox.exe
3240	firefox.exe
3240	firefox.exe
3240	firefox.exe
3240	firefox.exe
3240	firefox.exe

Suspicious use of SetWindowsHookEx 49 IoCs

pid	Process
3240	firefox.exe
3240	firefox.exe
3240	firefox.exe
3240	firefox.exe
3240	firefox.exe
3240	firefox.exe
3240	firefox.exe
3240	firefox.exe
3240	firefox.exe
3240	firefox.exe
3240	firefox.exe
3240	firefox.exe
3240	firefox.exe
3240	firefox.exe
3240	firefox.exe
3240	firefox.exe
3240	firefox.exe
3240	firefox.exe
3240	firefox.exe
3240	firefox.exe
3240	firefox.exe
3240	firefox.exe
3240	firefox.exe
3240	firefox.exe
3240	firefox.exe
3240	firefox.exe
3240	firefox.exe
3240	firefox.exe
3240	firefox.exe
3240	firefox.exe
3240	firefox.exe
3240	firefox.exe
3240	firefox.exe
3240	firefox.exe
3240	firefox.exe
3240	firefox.exe
3240	firefox.exe
3240	firefox.exe
3240	firefox.exe
3240	firefox.exe
3240	firefox.exe
3240	firefox.exe
3240	firefox.exe
3240	firefox.exe
3240	firefox.exe
3240	firefox.exe
3240	firefox.exe
3240	firefox.exe
3240	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 396 wrote to memory of 3240	396	firefox.exe	80
PID 396 wrote to memory of 3240	396	firefox.exe	80
PID 3240 wrote to memory of 3408	3240	firefox.exe	81
PID 3240 wrote to memory of 3408	3240	firefox.exe	81
PID 3240 wrote to memory of 3408	3240	firefox.exe	81
PID 3240 wrote to memory of 3884	3240	firefox.exe	82
PID 3240 wrote to memory of 3884	3240	firefox.exe	82
PID 3240 wrote to memory of 3884	3240	firefox.exe	82
PID 3240 wrote to memory of 3884	3240	firefox.exe	82
PID 3240 wrote to memory of 4552	3240	firefox.exe	83
PID 3240 wrote to memory of 4552	3240	firefox.exe	83
PID 3240 wrote to memory of 4552	3240	firefox.exe	83
PID 3240 wrote to memory of 4552	3240	firefox.exe	83
PID 3240 wrote to memory of 5900	3240	firefox.exe	84
PID 3240 wrote to memory of 5900	3240	firefox.exe	84
PID 3240 wrote to memory of 5900	3240	firefox.exe	84
PID 3240 wrote to memory of 2180	3240	firefox.exe	85
PID 3240 wrote to memory of 2180	3240	firefox.exe	85
PID 3240 wrote to memory of 2180	3240	firefox.exe	85
PID 3240 wrote to memory of 2180	3240	firefox.exe	85
PID 3240 wrote to memory of 3904	3240	firefox.exe	86
PID 3240 wrote to memory of 3904	3240	firefox.exe	86
PID 3240 wrote to memory of 3904	3240	firefox.exe	86
PID 3240 wrote to memory of 3904	3240	firefox.exe	86
PID 3240 wrote to memory of 1664	3240	firefox.exe	87
PID 3240 wrote to memory of 1664	3240	firefox.exe	87
PID 3240 wrote to memory of 1664	3240	firefox.exe	87
PID 3240 wrote to memory of 1664	3240	firefox.exe	87
PID 3240 wrote to memory of 2320	3240	firefox.exe	88
PID 3240 wrote to memory of 2320	3240	firefox.exe	88
PID 3240 wrote to memory of 2320	3240	firefox.exe	88
PID 3240 wrote to memory of 2320	3240	firefox.exe	88
PID 3240 wrote to memory of 3960	3240	firefox.exe	89
PID 3240 wrote to memory of 3960	3240	firefox.exe	89
PID 3240 wrote to memory of 3960	3240	firefox.exe	89
PID 3240 wrote to memory of 3960	3240	firefox.exe	89
PID 3240 wrote to memory of 3556	3240	firefox.exe	90
PID 3240 wrote to memory of 3556	3240	firefox.exe	90
PID 3240 wrote to memory of 3556	3240	firefox.exe	90
PID 3240 wrote to memory of 3556	3240	firefox.exe	90
PID 3240 wrote to memory of 1252	3240	firefox.exe	91
PID 3240 wrote to memory of 1252	3240	firefox.exe	91
PID 3240 wrote to memory of 1252	3240	firefox.exe	91
PID 3240 wrote to memory of 1252	3240	firefox.exe	91
PID 3240 wrote to memory of 3228	3240	firefox.exe	92
PID 3240 wrote to memory of 3228	3240	firefox.exe	92
PID 3240 wrote to memory of 3228	3240	firefox.exe	92
PID 3240 wrote to memory of 3228	3240	firefox.exe	92
PID 3240 wrote to memory of 776	3240	firefox.exe	93
PID 3240 wrote to memory of 776	3240	firefox.exe	93
PID 3240 wrote to memory of 776	3240	firefox.exe	93
PID 3240 wrote to memory of 776	3240	firefox.exe	93
PID 3240 wrote to memory of 2640	3240	firefox.exe	94
PID 3240 wrote to memory of 2640	3240	firefox.exe	94
PID 3240 wrote to memory of 2640	3240	firefox.exe	94
PID 3240 wrote to memory of 2640	3240	firefox.exe	94
PID 3240 wrote to memory of 1480	3240	firefox.exe	95
PID 3240 wrote to memory of 1480	3240	firefox.exe	95
PID 3240 wrote to memory of 1480	3240	firefox.exe	95
PID 3240 wrote to memory of 1480	3240	firefox.exe	95
PID 3240 wrote to memory of 5000	3240	firefox.exe	96
PID 3240 wrote to memory of 5000	3240	firefox.exe	96
PID 3240 wrote to memory of 5000	3240	firefox.exe	96
PID 3240 wrote to memory of 5000	3240	firefox.exe	96

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Gravethorn.exe
"C:\Users\Admin\AppData\Local\Temp\Gravethorn.exe"
1⤵
PID:2692

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:396
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Downloads MZ/PE file
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3240
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1972 -prefsLen 27097 -prefMapHandle 1976 -prefMapSize 270279 -ipcHandle 1928 -initialChannelId {bfba9265-3351-41e6-98ef-5a7573ed7486} -parentPid 3240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3240" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:3408
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2412 -prefsLen 27133 -prefMapHandle 2416 -prefMapSize 270279 -ipcHandle 2424 -initialChannelId {6a145602-3cc0-4779-b8e6-d56b66ea1330} -parentPid 3240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3240" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:3884
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3772 -prefsLen 27274 -prefMapHandle 3776 -prefMapSize 270279 -jsInitHandle 3780 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3788 -initialChannelId {243a3b8b-8bdf-4d5a-9467-80b674813c95} -parentPid 3240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3240" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:4552
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3936 -prefsLen 27274 -prefMapHandle 3940 -prefMapSize 270279 -ipcHandle 4028 -initialChannelId {9b2caab3-6ae0-4e4e-b368-2267b5d07203} -parentPid 3240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3240" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:5900
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3148 -prefsLen 34773 -prefMapHandle 3152 -prefMapSize 270279 -jsInitHandle 2740 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4528 -initialChannelId {359b5e11-7ef1-44d4-a3e9-65aaa785e718} -parentPid 3240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3240" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:2180
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4916 -prefsLen 34876 -prefMapHandle 4928 -prefMapSize 270279 -ipcHandle 4840 -initialChannelId {a25471c2-2fc6-43fd-821f-b611943ed0ff} -parentPid 3240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3240" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:3904
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3112 -prefsLen 32952 -prefMapHandle 3180 -prefMapSize 270279 -jsInitHandle 3184 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4764 -initialChannelId {fd1f4336-a495-4b4e-816f-3dc9993b6717} -parentPid 3240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3240" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:1664
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5672 -prefsLen 32952 -prefMapHandle 5676 -prefMapSize 270279 -jsInitHandle 5680 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4224 -initialChannelId {7d98d19f-81a6-481e-8c6d-1eb7a35d2d58} -parentPid 3240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3240" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:2320
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5848 -prefsLen 32952 -prefMapHandle 5852 -prefMapSize 270279 -jsInitHandle 5856 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5860 -initialChannelId {958915a4-07c5-483c-a5ef-47bd35260573} -parentPid 3240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3240" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    PID:3960
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6404 -prefsLen 33071 -prefMapHandle 6396 -prefMapSize 270279 -jsInitHandle 6400 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6416 -initialChannelId {55d3fb48-f67b-4e34-98be-f3394d8da316} -parentPid 3240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3240" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:3556
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4444 -prefsLen 33071 -prefMapHandle 3032 -prefMapSize 270279 -jsInitHandle 2900 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1580 -initialChannelId {628bb529-318e-40be-a466-9683cb11380c} -parentPid 3240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3240" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:1252
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6628 -prefsLen 33071 -prefMapHandle 6756 -prefMapSize 270279 -jsInitHandle 6764 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6772 -initialChannelId {79aa8531-680c-4610-b0d9-e6605c264245} -parentPid 3240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3240" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
    3⤵
    PID:3228
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 6952 -prefsLen 35198 -prefMapHandle 6956 -prefMapSize 270279 -ipcHandle 6928 -initialChannelId {e4805903-df15-43c8-94b0-76468ced07a3} -parentPid 3240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3240" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 utility
    3⤵
    - Checks processor information in registry
    PID:776
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7144 -prefsLen 36758 -prefMapHandle 5996 -prefMapSize 270279 -jsInitHandle 7156 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5376 -initialChannelId {d24b1dd1-de1c-45e3-9e75-04dff783268e} -parentPid 3240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3240" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab
    3⤵
    - Checks processor information in registry
    PID:2640
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6280 -prefsLen 36758 -prefMapHandle 6284 -prefMapSize 270279 -jsInitHandle 6208 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6204 -initialChannelId {94eb7934-00f0-45cb-a5c2-cf194795f0fc} -parentPid 3240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3240" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab
    3⤵
    - Checks processor information in registry
    PID:1480
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6952 -prefsLen 36798 -prefMapHandle 6956 -prefMapSize 270279 -jsInitHandle 2876 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6828 -initialChannelId {a512c1a1-25ba-498f-9e73-7b1bc2109143} -parentPid 3240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3240" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 16 tab
    3⤵
    - Checks processor information in registry
    PID:5000
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7816 -prefsLen 36798 -prefMapHandle 7820 -prefMapSize 270279 -jsInitHandle 7824 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7836 -initialChannelId {4daaa39d-b9a2-459d-8bee-d18046e67d41} -parentPid 3240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3240" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 17 tab
    3⤵
    - Checks processor information in registry
    PID:4372
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8156 -prefsLen 36798 -prefMapHandle 8160 -prefMapSize 270279 -jsInitHandle 8164 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8024 -initialChannelId {5662e991-16e3-4240-b8da-bbc5c0e96d7b} -parentPid 3240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3240" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 18 tab
    3⤵
    - Checks processor information in registry
    PID:5344
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2824 -prefsLen 36798 -prefMapHandle 6204 -prefMapSize 270279 -jsInitHandle 6716 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2900 -initialChannelId {41ddf712-a32c-4693-bfc9-210eda5ea152} -parentPid 3240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3240" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 19 tab
    3⤵
    - Checks processor information in registry
    PID:4968
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7540 -prefsLen 36798 -prefMapHandle 8008 -prefMapSize 270279 -jsInitHandle 8004 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7968 -initialChannelId {e54b6669-cf9c-4ddd-8aea-5ba84d215a66} -parentPid 3240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3240" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 20 tab
    3⤵
    PID:4948
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7788 -prefsLen 36798 -prefMapHandle 6472 -prefMapSize 270279 -jsInitHandle 7244 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6932 -initialChannelId {c9600d92-96b5-428f-a524-e71ef799464d} -parentPid 3240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3240" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 21 tab
    3⤵
    - Checks processor information in registry
    PID:5552
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2840 -prefsLen 36798 -prefMapHandle 7188 -prefMapSize 270279 -jsInitHandle 6820 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6816 -initialChannelId {38d1e5ca-78c4-412b-a61e-32972bae5a66} -parentPid 3240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3240" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 22 tab
    3⤵
    - Checks processor information in registry
    PID:5724
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7896 -prefsLen 36798 -prefMapHandle 5836 -prefMapSize 270279 -jsInitHandle 8312 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8340 -initialChannelId {f1df06e5-c71a-4e5f-ba31-25cc7e87c2e1} -parentPid 3240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3240" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 23 tab
    3⤵
    - Checks processor information in registry
    PID:5212
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5596 -prefsLen 36798 -prefMapHandle 6392 -prefMapSize 270279 -jsInitHandle 5588 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5812 -initialChannelId {4bd49b23-6b7b-4131-9b6d-c871c47cad93} -parentPid 3240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3240" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 24 tab
    3⤵
    - Checks processor information in registry
    PID:4660
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8464 -prefsLen 36798 -prefMapHandle 5724 -prefMapSize 270279 -jsInitHandle 5728 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4796 -initialChannelId {2a4a605a-b2a3-43f3-911b-6004c45524b6} -parentPid 3240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3240" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 25 tab
    3⤵
    - Checks processor information in registry
    PID:1276
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8964 -prefsLen 36798 -prefMapHandle 8968 -prefMapSize 270279 -jsInitHandle 8972 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8980 -initialChannelId {d989feb9-176b-4b2d-8ea6-f1ecb00413f7} -parentPid 3240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3240" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 26 tab
    3⤵
    - Checks processor information in registry
    PID:3148
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9140 -prefsLen 36798 -prefMapHandle 9136 -prefMapSize 270279 -jsInitHandle 9172 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9192 -initialChannelId {f9701df5-a158-4326-bd8b-f9eb04f4efac} -parentPid 3240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3240" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 27 tab
    3⤵
    - Checks processor information in registry
    PID:1084
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5924 -prefsLen 36798 -prefMapHandle 8468 -prefMapSize 270279 -jsInitHandle 9336 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8424 -initialChannelId {3a5dab5a-c907-43e9-a0fc-aa68624b30ee} -parentPid 3240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3240" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 28 tab
    3⤵
    PID:3564
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8544 -prefsLen 36798 -prefMapHandle 8512 -prefMapSize 270279 -jsInitHandle 4796 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8448 -initialChannelId {001f24c5-c4ea-45ae-8176-1af377e7c389} -parentPid 3240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3240" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 29 tab
    3⤵
    PID:1580
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9796 -prefsLen 36798 -prefMapHandle 9800 -prefMapSize 270279 -jsInitHandle 9804 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9744 -initialChannelId {0352717f-d584-4465-a2b5-8322f2b8d44d} -parentPid 3240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3240" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 30 tab
    3⤵
    - Checks processor information in registry
    PID:2496
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10104 -prefsLen 36798 -prefMapHandle 10064 -prefMapSize 270279 -jsInitHandle 10092 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10124 -initialChannelId {4673e795-14ca-45a4-bd89-455ddd4672e1} -parentPid 3240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3240" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 31 tab
    3⤵
    - Checks processor information in registry
    PID:3292
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10344 -prefsLen 36798 -prefMapHandle 10360 -prefMapSize 270279 -jsInitHandle 10364 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10312 -initialChannelId {2caf3872-a76d-40b0-b403-0a93fb71f4eb} -parentPid 3240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3240" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 32 tab
    3⤵
    PID:3696
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10376 -prefsLen 36798 -prefMapHandle 10380 -prefMapSize 270279 -jsInitHandle 10384 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10392 -initialChannelId {6f511a8d-a35d-4c8a-9b31-d512cf988c4e} -parentPid 3240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3240" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 33 tab
    3⤵
    PID:2640
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10812 -prefsLen 36798 -prefMapHandle 10816 -prefMapSize 270279 -jsInitHandle 10820 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10824 -initialChannelId {fa39dc4d-5a78-46fe-8ade-62e1fb64dd7b} -parentPid 3240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3240" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 34 tab
    3⤵
    - Checks processor information in registry
    PID:3372
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 11048 -prefsLen 36798 -prefMapHandle 11052 -prefMapSize 270279 -jsInitHandle 11056 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 11064 -initialChannelId {7bd6c66b-99fe-4ef7-845f-9b17c413bb93} -parentPid 3240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3240" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 35 tab
    3⤵
    - Checks processor information in registry
    PID:5432
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 11224 -prefsLen 36798 -prefMapHandle 11220 -prefMapSize 270279 -jsInitHandle 11216 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 11240 -initialChannelId {e9872f1a-045e-4d22-89f2-c653d33b9aea} -parentPid 3240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3240" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 36 tab
    3⤵
    - Checks processor information in registry
    PID:788
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10356 -prefsLen 36798 -prefMapHandle 10348 -prefMapSize 270279 -jsInitHandle 10364 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 11220 -initialChannelId {b23745e9-eada-4fbc-8c79-73a683b44f12} -parentPid 3240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3240" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 37 tab
    3⤵
    - Checks processor information in registry
    PID:3188
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10348 -prefsLen 36798 -prefMapHandle 10364 -prefMapSize 270279 -jsInitHandle 10360 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 11240 -initialChannelId {471f178f-b750-402a-90ac-2c4e37882297} -parentPid 3240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3240" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 38 tab
    3⤵
    - Checks processor information in registry
    PID:5680
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 11784 -prefsLen 36798 -prefMapHandle 11788 -prefMapSize 270279 -jsInitHandle 11792 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6000 -initialChannelId {22bd79c1-7e93-4f46-8ad3-9e9df3ce40ff} -parentPid 3240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3240" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 39 tab
    3⤵
    - Checks processor information in registry
    PID:5912
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 11940 -prefsLen 36798 -prefMapHandle 11944 -prefMapSize 270279 -jsInitHandle 11948 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 11956 -initialChannelId {53ca5ed8-a60f-415c-8f05-762f967518b9} -parentPid 3240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3240" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 40 tab
    3⤵
    - Checks processor information in registry
    PID:4656
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 11820 -prefsLen 36798 -prefMapHandle 11816 -prefMapSize 270279 -jsInitHandle 10064 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 11696 -initialChannelId {d078cf48-2b78-4e7e-8c71-b9be044e154c} -parentPid 3240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3240" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 41 tab
    3⤵
    - Checks processor information in registry
    PID:3608
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 12236 -prefsLen 36798 -prefMapHandle 12204 -prefMapSize 270279 -jsInitHandle 12200 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 12224 -initialChannelId {477a131e-f300-4b1e-ba67-d3344d2cd93a} -parentPid 3240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3240" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 42 tab
    3⤵
    - Checks processor information in registry
    PID:1524
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 12104 -prefsLen 36798 -prefMapHandle 12100 -prefMapSize 270279 -jsInitHandle 12096 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 12608 -initialChannelId {1ee40ac5-3582-4d4e-8ed9-c379a9e24f70} -parentPid 3240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3240" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 43 tab
    3⤵
    - Checks processor information in registry
    PID:6356
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 12656 -prefsLen 36798 -prefMapHandle 12660 -prefMapSize 270279 -jsInitHandle 12604 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 12592 -initialChannelId {79fcada5-e1ac-4fd5-b332-547be0506a6b} -parentPid 3240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3240" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 44 tab
    3⤵
    - Checks processor information in registry
    PID:6368
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 12812 -prefsLen 36798 -prefMapHandle 12808 -prefMapSize 270279 -jsInitHandle 12804 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 12672 -initialChannelId {baba1823-94e6-4b37-b6a9-8de04886ac7a} -parentPid 3240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3240" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 45 tab
    3⤵
    - Checks processor information in registry
    PID:6668
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 12236 -prefsLen 36798 -prefMapHandle 12204 -prefMapSize 270279 -jsInitHandle 12208 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 13116 -initialChannelId {93f294a2-ed2c-4e1e-a3c0-2a8202c2175d} -parentPid 3240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3240" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 46 tab
    3⤵
    - Checks processor information in registry
    PID:6792
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 13140 -prefsLen 36798 -prefMapHandle 13144 -prefMapSize 270279 -jsInitHandle 13148 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9144 -initialChannelId {4b93c72f-f83c-49ef-a17c-0b4a3e986f2c} -parentPid 3240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3240" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 47 tab
    3⤵
    PID:6800
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 13512 -prefsLen 36798 -prefMapHandle 13516 -prefMapSize 270279 -jsInitHandle 13520 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 13496 -initialChannelId {aea2e763-f5ab-499e-b109-242ce45cc9df} -parentPid 3240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3240" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 48 tab
    3⤵
    PID:6884
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 14424 -prefsLen 36798 -prefMapHandle 14428 -prefMapSize 270279 -jsInitHandle 14432 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 14436 -initialChannelId {b4f39607-aea1-4877-b769-cdfc717c5a2a} -parentPid 3240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3240" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 49 tab
    3⤵
    - Checks processor information in registry
    PID:7652
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 14604 -prefsLen 36798 -prefMapHandle 14600 -prefMapSize 270279 -jsInitHandle 14596 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 14648 -initialChannelId {e39e55b3-9fdb-4680-90ca-f76de82130be} -parentPid 3240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3240" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 50 tab
    3⤵
    PID:7660
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 14868 -prefsLen 36798 -prefMapHandle 14872 -prefMapSize 270279 -jsInitHandle 14876 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 14820 -initialChannelId {0efc23ad-fc6a-47e4-8db0-7709daa7d148} -parentPid 3240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3240" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 51 tab
    3⤵
    - Checks processor information in registry
    PID:7668
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 15420 -prefsLen 36798 -prefMapHandle 14264 -prefMapSize 270279 -jsInitHandle 15416 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 15408 -initialChannelId {442e580b-1b70-44eb-992b-312a1a43ea0d} -parentPid 3240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3240" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 52 tab
    3⤵
    - Checks processor information in registry
    PID:7116
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 15476 -prefsLen 36798 -prefMapHandle 15480 -prefMapSize 270279 -jsInitHandle 15444 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 15132 -initialChannelId {c82297a4-8479-457f-8b11-b29586e94ab2} -parentPid 3240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3240" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 53 tab
    3⤵
    - Checks processor information in registry
    PID:7856
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 15560 -prefsLen 36798 -prefMapHandle 15564 -prefMapSize 270279 -jsInitHandle 15568 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 15512 -initialChannelId {97efa0af-eae3-4bce-a69b-965a1f2f67e0} -parentPid 3240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3240" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 54 tab
    3⤵
    - Checks processor information in registry
    PID:7868
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 15116 -prefsLen 36798 -prefMapHandle 15144 -prefMapSize 270279 -jsInitHandle 15152 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 15764 -initialChannelId {a0cf4c3a-2f24-4c37-b4ed-6609391883e5} -parentPid 3240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3240" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 55 tab
    3⤵
    - Checks processor information in registry
    PID:8084

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:9180

C:\Users\Admin\Downloads\Gravethorn.Build.22790733\Gravethorn.Build.22790733\Gravethorn.exe
"C:\Users\Admin\Downloads\Gravethorn.Build.22790733\Gravethorn.Build.22790733\Gravethorn.exe"
1⤵
PID:3712

C:\Users\Admin\Downloads\Gravethorn.Build.22790733\Gravethorn.Build.22790733\Gravethorn\Binaries\Win64\Gravethorn.exe
"C:\Users\Admin\Downloads\Gravethorn.Build.22790733\Gravethorn.Build.22790733\Gravethorn\Binaries\Win64\Gravethorn.exe"
1⤵
PID:6440

C:\Users\Admin\Downloads\Gravethorn.Build.22790733\Gravethorn.Build.22790733\Gravethorn\Binaries\Win64\Gravethorn.exe
"C:\Users\Admin\Downloads\Gravethorn.Build.22790733\Gravethorn.Build.22790733\Gravethorn\Binaries\Win64\Gravethorn.exe"
1⤵
PID:1532

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Path C:\Users\Admin\AppData\Local\D3DSCache\4b31f1550873cf15\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
Size 64KB
SHA256 3b83d8a2362b144094a72cef77c3a3e948b7b8769f5bdd91515c8ce7ec556302
MD5 8bd1bb4d94fa633c2589fc6808cb831b
SHA1 449a14b374e13422b3ced22c8445ca9e5fa02710
SHA512 23082ec84f2bb5e87c5df1b23777942ae8fbfde62f18cbd3f8de676158612c9ccffa6feb82eeee0b7bce3d834bd8e444727add067b2923a5e425152a0fa9b9fe
SSDEEP 3:t1HlGlll/l/lXp9ZjrPBY0Xp/PpxwRP:jH0dPBY0hhg
TLSH
T10D53244011C71117C443033004CF07503D345704C343015343344130CC5C30415703C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Path C:\Users\Admin\AppData\Local\D3DSCache\4b31f1550873cf15\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
Size 4B
SHA256 7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba
MD5 f49655f856acb8884cc0ace29216f511
SHA1 cb0f1f87ec0455ec349aaa950c600475ac7b7b6b
SHA512 599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8
MD5 SHA1 SHA512

Submit Download

F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Path C:\Users\Admin\AppData\Local\D3DSCache\4b31f1550873cf15\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
Size 1KB
SHA256 fbfd99cf911e125049d55e97ebec98754b536e5f068a5c7fc7644d385f7fc155
MD5 d6e15f44f860cbbd75fe96741e305e24
SHA1 21fa15668d25e238a1f82e5af254e67f7af5b6cb
SHA512 44bbaf0f3e3073e40a0ce15fcc8ca89c883cf7cbf7ef29cb26d4c5df650e093894eb8f9990743a8a0e530c9295b49e4c8103748667ef6f06ca66741919420fed
TLSH
T10C218CB657E30A28F7BB77B000BE91B2133138C66C8AD62C48DA84584F31214D8E0FB2
MD5 SHA1 SHA512 TLSH

Submit Download

39172F2924E6689A994995A9C4E51BECDC2078DD

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\cache2\entries\39172F2924E6689A994995A9C4E51BECDC2078DD
Size 23KB
SHA256 ea5257f008e7ca33d83f70e5c03e6f9f7e27e9c0bcc8dae3594014e555b68572
MD5 7ff3138e821ef0743fb027c9f7104f35
SHA1 3936509b87b76b39d30df504eaed4a19c58aaf4f
SHA512 16a8ddbac8b0f616e35ee4e9c3130e8c98ac86bbac829bfa47657fe3df68f02229f3fbc467490aeb247574609768556f6caf9e6bf80aa2ce6cd222a1d3c8ee21
SSDEEP 384:Ltp1VuN8nvox4cw6esDQWnY3gJh241f4W3Rzjrp9DT/Scp54cwYy1AuT:LtB7voScwpsEoAgJhB1gW3RzjN9PKcpO
TLSH
T131B2C0B78A090D344F41DEB89ACB6B8C7E21F9972755D0FD93682741C126334E4BA4DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3A37EED3D1E6B3845C02BF0570CEDAEFF93A93F5

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\cache2\entries\3A37EED3D1E6B3845C02BF0570CEDAEFF93A93F5
Size 82KB
SHA256 46491264d26a6b88c468d0e2ded5427115d54ec0bcd6317ebb7d577f70a21b4d
MD5 f728a983691a7482c262f187be1f4777
SHA1 34361fe63670d445c817b7183424115e81e79de0
SHA512 7bac7d75a051877cf463b266d2a9516114337664ea57151b3f2aa6160a35646eea606358f0d53ba3d2a931334fbe3315d06503aba7067411028b12afa91c41d4
SSDEEP 1536:9+BtIuGx2g9hqmCs7pV887zFOCWwS5Z9jBV/mGyFL9u8M+ABqPosYw:KtVGllV8DCWH5zNA5M+MqPosYw
TLSH
T1BA8312712FDCFC024E9AA0D2C44AD0993E7A7EE650F6E81E15007D4285F869DA56B07E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6560A8E0C3A020DB9AC89CBEF444B8FDB08193B7

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\cache2\entries\6560A8E0C3A020DB9AC89CBEF444B8FDB08193B7
Size 455KB
SHA256 90ef39c7df6db1e285fbe86458bc425b48b2ca836c88f96970b5095d7d2f4632
MD5 301b084541e6b5fdaa3870a228ef1c27
SHA1 bf1091cc9bfa0081bec5415b147e47288ffef024
SHA512 d9a2330525246b45465a8dbca501eedb9f3b5e0798b46f694a4bafcbe65e37acbe3d23187e0a0d500b4fe853e3fc2e13dee0ca9465edb161abed26f454add9e2
SSDEEP 6144:d0f4p5oIb3VvKxVgb42zf9/6jr5fwLerortj6Ig52H5RskIt2zFJKIpjlvURm7Cy:d0ApjtKViDzf9iZfFKIo5
TLSH
T191A45B7B7BD06DB3C9A30372806343233731D5946786DB97661AF0A66C65ADC1C22AFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6FEFC472049FD0474F77C9D66E3FC8D246D9645D

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\cache2\entries\6FEFC472049FD0474F77C9D66E3FC8D246D9645D
Size 171KB
SHA256 0422f0af33d6f33c45c3eb513c345598ef697b08e3e5effcccb5ccf6296822ab
MD5 dcc04b9ff51e02d78de4474d0f7f7f21
SHA1 6025c698526f9bdacef7b6f1c9d84fa5a1061517
SHA512 85483dcf66e4656f6d52c8f4e445eb8e8f2db86d163f0a6299a0a85cec7971cb48f3e62620cc99e9d711d5f5cf9e09eeea7b1039979adcde53c89bcfca5a95c6
SSDEEP 3072:mkbEuF51Mz857ZQ6dc7ZLs/uh4XBnBb8lhQ9nMIMZjh1PEc5AADo+LgOZj:mHwgQ5/dQsGChw/1PgOF
TLSH
T1D5042239DD288A88EBFC43C680D8B5FF4825DFBB9D7875C6550264C128EA13063F4D66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

73A0F2F348546E864E90FB9E4AEFC3CFBFFD2187

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\cache2\entries\73A0F2F348546E864E90FB9E4AEFC3CFBFFD2187
Size 700KB
SHA256 f357600a85ad5a4613a3c59d3839b2256610e7d93698d2e57a14005e8cb056f1
MD5 c815780adf2170ce5e06c15cda3b724a
SHA1 602d9d9bc5c905fa9b11da76f6397741ac8a3e80
SHA512 8d5ce512d83066d9dc45c4956adbd8935b50f6f1f44bb12b6f786970b4210b6b3ebf3b268e638a42c305850cd9f16838ccaa4a97a06e0d99c11b1c8bcb936638
SSDEEP 6144:ClM7X2qpePc7/bQZh2TgvO/8l4n/pAHbn7q/IpV:C+h9jFgvv5
TLSH
T1B4E4C62EEA920F66C851127641E357703B38D0A46FD7E3172E5EF93ABCA67590C071AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8CDFF6D57AE52C4CD270595439B55170743D2258

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\cache2\entries\8CDFF6D57AE52C4CD270595439B55170743D2258
Size 113KB
SHA256 adc83cdb3cdc4ac1fc19082154942cc8d3505be98324cd72d56d49e47ea2b534
MD5 304f4d6e4fb960aa013032cc1d2b5ae1
SHA1 8c5eee23f2ced652732c69d3d3b5b7eeebc01bf9
SHA512 6e866990634f13b3617199e6db32603a09fd0bd469e7c53de14ef15363bce6aa63f3d3dd1b3d3ae7c766ea699ee3e3807a4a59dd276928be8e4012b85485c79f
SSDEEP 1536:Dut3doytDpg7ezpAullJ9YtpDaIsvOTzkXWoeEj9PuZLlXMY8PoU:qdvtDXCulljGWI8S+WSGZLuPoU
TLSH
T129B3D626EE519A13C82103F140EB27363A35E0916796F32F7ACF7156FC5A3B50DA16AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

A3B32843813920235BEA8BBDDDB52695F7D61272

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\cache2\entries\A3B32843813920235BEA8BBDDDB52695F7D61272
Size 376KB
SHA256 a115d8aa0055a7a37eb9f318cc70dfa5a22f15e5ba088dbe0ec4b7d339a9ab41
MD5 bcf0f827f8d4d986398a91e79e505c32
SHA1 3189e9ced396043ae6739f7080d03253ecf6ea64
SHA512 24576417eed7cfc4caffda168915f2191957e3b9010c1f9f1b9b7c27ce4f5dc8d3eda71293382ac842156bb7a4b687c8b4c36c01848e20f5c51086960ab946b6
SSDEEP 6144:w8vtFm8H7kbWU5b6tdctNApOzwsHjpVmK4wCGhtL5S:w8vq8bSXApOzRVIwCh
TLSH
T1C484F77AFF915F53C820077141A767363B30E84967DAE3176A8EB12ABC1A7AD1C501EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

A59DD50D8545CD3464D967636AFDFB6AAA47B87E

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\cache2\entries\A59DD50D8545CD3464D967636AFDFB6AAA47B87E
Size 71KB
SHA256 fa66d473304f718b02af208c232db5948285d2ab279baa62b579ee72fff8be67
MD5 def179bc46974df18e887f6ea0a4082f
SHA1 47ecde1ffb1f69e12bed050d2789fd5dff9f5313
SHA512 d34f0bdb85a914e858330c2dbfeac6b307f125619160f9a9e2f9300e121ae58396f27dac8b4c4b22750edcb3ec2a6772c397dfc44e84cb68eababddd6d9136fd
SSDEEP 1536:SBCTsMgneBKlCiMRJjvj+80TDITr99RXFESpGzJ8qlmJRqwCjKxr:tTi14zyTDg51ESpqJ8Uor
TLSH
T1D4635BF5AA144D0FC83203B29FF75B743A3B9652A7C3A64FEDCA622139553B94C0589C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BF9CD63432E1C1EECACD717BB58973173BEA72AB

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\cache2\entries\BF9CD63432E1C1EECACD717BB58973173BEA72AB
Size 171KB
SHA256 a1f0b36bf1c56e441ef39151b06be3ce24fba456112d0d0ac3248ab3af6a4826
MD5 8722571f0e0954507284cc43d518c5db
SHA1 c848b3b9a061503ac6906c626fb393c951b0bc75
SHA512 8e1650bef050869abec2a50829b7b1b027fdbe4b375d3f17f47d59faaaa0b16acf1eb6c5a174ccd894b143a1374d6d8149a76fe45dd1feede99edb82a9749e32
SSDEEP 3072:k60H3T6pN6ELwSOthwsRX4SPF1sXFbf7u2IP73ZyYTBmyyiMIxM2BVpQ:J0H3T6pN6ELZyB1VM67sEc
TLSH
T13904127DEC3F6F948E46FADB84650ADE272662A308DF703F1149E54031621BA95F21BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CD1C116DEEE8F4F97C1806976E10E7E2B349E486

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\cache2\entries\CD1C116DEEE8F4F97C1806976E10E7E2B349E486
Size 13KB
SHA256 9165ff2fb96a4c5868c35b479510f125f428ff9332f4ae81c14cc4b1a4a530c4
MD5 08808962d29d66262df3446af8c462ba
SHA1 c13b6d7bb3a21396c795573af74cf0a781bdbeef
SHA512 898a611b0ff245926123473451577fea925fbfdf17f6623360450638caa3718474ea43729dcfd433ca124e9a5cd75900933e1e825dce6bb40f4e084b3527678c
SSDEEP 384:HbaFrLiO024YJFuhw+5EL1pPsac4j0lpDII+3OxzOxs:7aAZYJFuK+5EB9sac4ID8L3WL
TLSH
T1E7527E7DAF0138BA1A2BD2D4D9E99304CE04D6BBEEE6D15606143C44C6843BDB8F64DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\AlternateServices.bin
Size 37KB
SHA256 188b3815ce96d4d3ef724a85317f40ba61575b753cce4213ac5ce1725dac6b91
MD5 f2ff7a882bafce0a3eceab4e6b733b08
SHA1 c14d919612fb7bef3cc78f9528bf626428670a04
SHA512 93f44df4347d3887afc2bf73d15c65983653bc146b1853aa3bff7903fe6764dcd722ed2eb231b3d2e9ca0d3b7e5820b46c8d6ace8fa6261c371f6ab817efba81
SSDEEP 96:yKM/prWcvMnMs3ZbcEWbsw1yUJs4UHKC4l1BG3Cw00YnpoepxaeXD/rT:/QMcc3ZYEW56fYpo0xa
TLSH
T18C03F2F75BB668A5F56A6F71009C7E9C8C33021618D68184CB14E4EB0EC1BA4D47BF5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\AlternateServices.bin
Size 37KB
SHA256 42733b50ab9f00bfdaeaa0b421dfa9e9ee1cb10a6fdf74591d22988943897472
MD5 edb209ae93c7e2b87065dbf75e499044
SHA1 5ced787bd0e5887efe6026c234b0d341a33cf319
SHA512 a52fa8c6824471c0a559b06830136dcb8784904aa51179433e7eaa50695fc90bd8921c3c492f3cb2bd7eda4f20ec4eb20f4336aead67102b163fc6e00b221490
SSDEEP 96:yurGhGjG5xZ/9Vxu2+M/prWcvMnMs3ZbcEWbsw1yUJs4UHKC4l1BG3Cw00Ynpoel:+xZ/9Vxu2+QMcc3ZYEW56fYpo0xa
TLSH
T17403F1E71BB268A5F1BA6F71109C7D9C8973021A58D691C4CB14E4EB0AD1BA4E43FF1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\AlternateServices.bin
Size 67KB
SHA256 b1371ef74528b6c909402d7fd195615ca0ac63ed43130531089ad1671883a799
MD5 ff93ef75d0f41a3ce0b0cc125dc47a5f
SHA1 b9d0eec95e3eaec7b03844e0a224873403c70ac2
SHA512 ce78bf7a6f05d2fe32606971039ec107b4c5690ea5d50c2028a90c5bb009bbc35f862e75feccc83efe224111c124f0ae8114aace0641b16a489ac0f9be4b99ff
SSDEEP 384:pxZH9VYu2+Q8GEWtxZcfYpo0xa6Y7vVHsBhB5B:qu2SGEWtxZpo0xazSf7
TLSH
T17B63F4E707B26461F1BA6FB110AD7CD8897311195CE195C4CB14E8EB0AE6B60E63BF0D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\AlternateServices.bin
Size 10KB
SHA256 eb025196d94b21845d9e65bcc9f49d6387af4a3ebbfe648c0524227a23d6d0bc
MD5 f5ae218035c4cb60f81573607d917068
SHA1 b83499be0c8a8c69df936e715a4f0529c8fb2896
SHA512 bd32b91f92d5e77a383afad2a161897e11bc989bcfd31346d02990e10cf947b4f2556ceba707977a09928d611091ecbf2b165267ae66d62183a959a5254a97df
SSDEEP 24:juhMZPV8ro91QU89M9xsj9o9BIj9o9VvOj9/5q9F55A5Lj9c9lWj9b9BbEY9:deiWf+2RiqRiBORBI56LRO8R59ES
TLSH
T1D22288F76BB274A2F0A2CFB04099794C9C33132915AD91C4C75494F74AE5F99903EFA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\AlternateServices.bin
Size 25KB
SHA256 082a1847f0242924c3efc400c7888502deab62137c6eff75404f9ee305137b2e
MD5 817ff89887f609888d1c1c230572c5fa
SHA1 80d033877cf341d2c5d74b5dbd5bee06ad972722
SHA512 63ca964e67344363ce84224f14c486d90b6c7cc46559bee230f9527b047eb08a8ec0b60d23ebc6fc1742f5f149e41ee0b1ef04606a6d71f8452b779b8d9a9e43
SSDEEP 96:y20+Ci2iBaBI56VOc51HM/pQkMYMGMWMmMyM8jMMhtMH1Ffw1yWKg4n25oLpbBbX:uQ1dhwtPnPn
TLSH
T146B2B7F767B6A462F0768FB150987D8C8C33122919ADC1D4CB14D4EB4AD1B95903FF68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\AlternateServices.bin
Size 28KB
SHA256 ddcb1c684ec7b8bcbcd2f50312a6e94be5ccaae014927050f89adc39e8ea7d44
MD5 0e7d757a599b3297bc7694969d1c25f0
SHA1 ef0a309f2c4063a787aedbf689ecf558c3cb766f
SHA512 9cd2dc7f9e2ad3ab73c5ebbc9e24cdc9f3027f0a7b208cd29f3230c2697fe97309cd3181e217276e98a3dc56d32ce04fd749f014a0e5742dfb0d432e1396e7be
SSDEEP 96:yKQp5J9TBxCI56mHX51HM/pQkMYMGMWMmMyM8jMMhtMH1Ffw1yWKg4n25oLpbBbb:CQ1dhwtPnPnG7Ho1kktHrf
TLSH
T1C9D2C7F767B6A462F4768FB140A87D8C8C33122918ED81D4CB14D4EB4AD1B95907FF68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\db\data.safe.tmp
Size 125KB
SHA256 302a25cac78ff32ec3195aeb6790a9d6eacc6b36268ba90e7f9647481e10c323
MD5 013dd0fbdda1da670e417e6e41dc4f07
SHA1 3712af676ecd9397834add70dc6e5d218f8bca4e
SHA512 4243d8286aa88269b519300be19abf516a7b70ac301ebcc767ec1497db07680935e5fb7e2c81a3ed054761147da4ca79be4d8d6e8dc11989ee2132cf4dd2c079
SSDEEP 3072:mof/SJE+ti6kmueeikHrU9c1kV6zt/svxlUFdv4fIF:monSJE+ti6kmueeikHrU9c1kV6zt/svM
TLSH
T1FBC38DD4DB1A407BFC1485BFB495673C2635F4214A599B0B3AAC04761DCB3FF2D0AA2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\db\data.safe.tmp
Size 105KB
SHA256 7a205fd7a4efc9a150b7db8158ebfb9a2a98419ee47b9c7ae278bcd54e7fc11c
MD5 a12cbf96b21a53819a3666ed98875f7a
SHA1 c739a57de50cf89d8df940e22f86add4c928a5f3
SHA512 c2d49abd04085ad5742e7dec2893c795f1602f7e448e7947db108f0402ede62505d9c1964ab7f32c8103761e27d00e4db425c2c59769acfb44962d2a90853a0b
SSDEEP 3072:njGS4FhP6hclJLL2/M8q7c9OXix5CQpTXasF:njH4FhP6hclJLL2/M8q7c9OXix5CQpTn
TLSH
T1A0B30E44EB5A953BD92803BA9DD21B103F78F88D5B1A2B57271CA4343D873DC2D8E16E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\db\data.safe.tmp
Size 29KB
SHA256 59f91a1776b7c5d84c7c2389750b3993611df931214ab59b2945af3b9e6fc313
MD5 44739155a5e95a6722294688672cf9da
SHA1 fdd053f11dc029716712691c429290cab907adde
SHA512 e35779c281950738238455fae3eceff28e4be1588245bc7c59f9c193ab727c2e41348b9fd2475aa823b750c73a627dd58b1c90fec5fa18b7e902cf55aa410f58
SSDEEP 768:nC4YIvljGcmhu/2RJH7iHubpb5bPb8GmM3N:nC4Yq2us
TLSH
T108D2F044EB2E953FD41512BBDCA55B002F78B88A58192FA73A4C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\db\data.safe.tmp
Size 30KB
SHA256 660f187ec2c9f695e292e9b5f5f51e683b6edd1453137f6e6ee7f217345475d5
MD5 a7aa4d8208675848fc9ec5769c68cdad
SHA1 282a97d8e5ca3a1da5434c7114946422a7ac2d2d
SHA512 2fffe1910878dd9d417badacaa1a49bc3ac56baafb196fe62fc72ba25ddbc6ec6de80cce712b78476253d8c0a20f80608efe633f6c0be4e77cbde9ee7c6c8683
SSDEEP 768:LmAC4YIvljGcmhu/2RJH7iHubpb5bPb8pxd:lC4Yq2uV
TLSH
T1BEE2F144EB2E953FD41512BBDCA51B042F78B88A58092FA73A4C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\events\events
Size 1KB
SHA256 ffee7e617de0cbaa9499cd61d5a2af7ada91428ffa94d4539bcc6d533b0b0681
MD5 5b53822cf7edb986b4d9d56374d696da
SHA1 61f529adaa26127433d4eb766ef740b4ddad069f
SHA512 b612ffa90629cfd60f32cffcc86437199a3e20b009082c17fa788bc714ca2312b2c8a79f738e1d4cd7b87631b774d8bbffa3a87811d35d9086d122b538427249
TLSH
T1D9214F9C39B84DAE799FF25C74910B8E53954E0A04871C838E42EE8DCDC5FD9316E838
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\events\events
Size 5KB
SHA256 8b2b1ec91e65ee5dfb775350ec2f47a422eb2d6d23066cf0f77a3824cd289c54
MD5 7c19587e3a562ab6c6edecb8eccd942d
SHA1 a29d11d05d1cbadc034c304b26fdb17719017960
SHA512 82c4a3d2380efb8636207907c2aaa283cedca1f8e75c5cc00a16ff57cfd61512738ebf332a28f1e379f7f954983a9ce2c0626726244dc5111054c6c67101c02a
SSDEEP 96:+q3olcYh68i4wpq3qdGQdd3do6TPCJpmSXpwk:+T9i2MGWNoYkQmpwk
TLSH
T133B1FD5D35B90CBE3A9FE29CB8800B8D47994B0394C71D878D87DE49CC9AF99325E439
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1258cfb5-2f42-446e-b481-f7888c85a177

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\pending_pings\1258cfb5-2f42-446e-b481-f7888c85a177
Size 871B
SHA256 a52fd619812bb2b4c1ca5ada6b554159a40e8e4cb42d0abab13b2b507e9e3204
MD5 59d0f56adae8ae40884f9ab8b19c937d
SHA1 6efa21db98cc6149c75893212529df372992e5f8
SHA512 acafe12d6042336e46596ac1b1ff964b64cf1d2dec952ba971ae39605bd0f81b77098e13a49a648a89f4d3e657c2e8fc98a2c29d236eaf7d4011d5a37ae47542
TLSH
T16411C051D734B9E29C7CD29B86A13B529BE4751380C644183FA46D080E7A52EE766707
MD5 SHA1 SHA512 TLSH

Submit Download

1871fb60-fb97-44b5-b694-0bf299ecf3ed

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\pending_pings\1871fb60-fb97-44b5-b694-0bf299ecf3ed
Size 235B
SHA256 d1402cb56b35c22d6c106f5a3846e97fe2a758a42de5b9957e07008a01cc5d03
MD5 5cf640808331e93f65ca5dc7c26dd8f3
SHA1 e3529f37871245ee2dfa2ede8bb420e135274c69
SHA512 f6b201ce75f117d63ee37820793de79f27fc2a112323eaf878fdd861320408bee404d19ef3b5e6ec6df3396bac731c1f95fe868e27e3e563e5145a5cf790281d
TLSH
T1AAD0978828D8631C0C210F02F0E02DC230944C3760BC5C2089A148B89AFCFC94212A07
MD5 SHA1 SHA512 TLSH

Submit Download

334043fb-7f04-42c4-91d2-b7c3802e4a92

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\pending_pings\334043fb-7f04-42c4-91d2-b7c3802e4a92
Size 281B
SHA256 99156478586999a830134d0919f63b6c202e8606aa8d64cdf6c28e0896115f48
MD5 4b532871ff21743dee1c04976b9e94ca
SHA1 ea90efc9f19e1b343d212fff3cf1defa2b47f138
SHA512 41fb5019c1fcdb847508c00919514ea2d67a849c798ef402c2d05f3d0687335230ca9e34a1d3be46ed4483126f2659fe3e64a26e3d7a476d7a66afde6200532b
TLSH
T1ADD0EB843CC8221D4C680F12F0F034D3346A0C3200E84848C9A004346AFEEC98141D2A
MD5 SHA1 SHA512 TLSH

Submit Download

5e04ee65-feff-4844-b48a-5d217d133873

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\pending_pings\5e04ee65-feff-4844-b48a-5d217d133873
Size 1008B
SHA256 1845154ec282442c087fe28c00c8593e4c91f7aa6be81faf8157921b917aa007
MD5 73eb95b2aec16023ce86aac72cb6c08c
SHA1 7a37a24bb878f0ec907de20bc9d92e3c8a16f9b7
SHA512 93bf69a9acf3451e584a8091e2bd6c9680eb37f8a4ff34739518e207cd06646d01bcfcfee858eac948be5aae48d42f62a6fa6e173149d755b248fc6db0749486
TLSH
T143110E50C57078F29C79D3DB99B437926BB47823C0C54C083EA4AE084EEA56EB75A717
MD5 SHA1 SHA512 TLSH

Submit Download

991e4183-3267-4c8b-9b50-b6971cc7af65

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\pending_pings\991e4183-3267-4c8b-9b50-b6971cc7af65
Size 34KB
SHA256 8a33d9c13dc8fb5b50af894c366bb75316bb7a5ae78c497677ce84cdf7ac4429
MD5 1f2d7efd7e660d7cdbc7d41b72f04a42
SHA1 21161d42629f062433c087bc4f3e6803d1ae0817
SHA512 8c994d326e9e06d9f384bfc3997cb32da4e08123e8cecc2ce19148cdd6e0fa6ebedae3d6a1eae79711ce5f016820d570722f8820afceac398bb1880314a6785e
SSDEEP 768:feFR34ehPSKI2jE3yVpdVt7F5Gqiv69j9xowzwn8nazkxGfk32FbXDCxX:4pFZjE3yt7FPvi8naziGgZ
TLSH
T1F6F23CFDDD1200473D25E51EB2EAAD6B2057183249DC87DE69FD083A2BC6DBB0527368
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c3215838-4e27-4ee5-b0d8-89d59b217708

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\pending_pings\c3215838-4e27-4ee5-b0d8-89d59b217708
Size 235B
SHA256 6823a7e6e9a17e487b13e20c98ab5f92f82019d830dee73215745a0dc63b923b
MD5 ab52e36cb1d0f63c400fcb27ac5686f5
SHA1 203f559f3d9e4565c2a191e439c0ff77b5ade45a
SHA512 81a00dae432e58dd0bdfab92d1276dbf67e9d3b03ffe34beaff62e690c2b3532ff52f65ba49943cc10e54f162281011bc2a10bfb144ced1065f223a2af239646
TLSH
T10ED0A78528986B5D08141F07F1A169D731984C3314A56824DBB15574D9F9DCC42A1916
MD5 SHA1 SHA512 TLSH

Submit Download

df7be8eb-fa41-476f-a50e-6cb40f51887b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\pending_pings\df7be8eb-fa41-476f-a50e-6cb40f51887b
Size 886B
SHA256 e98b46dbb743992776f40b3ef0fcfb3815306a5b1701360bcca9b42b392e6863
MD5 ab015389b671c296dcac85224f00645f
SHA1 81292c8b40e7cb1cf05dc0eddb360ea706b2d1fa
SHA512 59438547d5aa0e777e315c0d159c582065f13160f1d769cf99841f7448c4c03e3224077e893a20d4a787b275d028e5ac40e121e6cbe317108203efc6b647eae4
TLSH
T1FA112750867479F28C7DD3C795B07B4247E07523C0C659083F945E1C0EAA16EA76B317
MD5 SHA1 SHA512 TLSH

Submit Download

e3cff00e-fbd9-406a-9e40-b634312a7894

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\pending_pings\e3cff00e-fbd9-406a-9e40-b634312a7894
Size 2KB
SHA256 1620a559a8dd08ea14b13a7e1435cfc67890446a5cfdff90cee7a0c4bee90514
MD5 5aa601cd9d45a525864b838cd9fbef1f
SHA1 b0c357d7f0b9b7d2dde4c8dd5ebe88575897c88e
SHA512 f20449f1fd15f981c36f0f67bae2e807464932f486cffce0f053c9527c5383590aa3e12b65bbcb8dcbf37163b5007c91671277f8b7dd6597dc4f3c11e3592e2b
TLSH
T1CC41446C35784CBA9CDAF19DA491338E53608A4304C22C432F51DF4C8DDA6DA736E42B
MD5 SHA1 SHA512 TLSH

Submit Download

ed08a521-14e8-4160-a9d5-6ef364b68c99

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\pending_pings\ed08a521-14e8-4160-a9d5-6ef364b68c99
Size 8KB
SHA256 3d9aa3171203118824fb4dbfd865da7dfe6eeb8b10607707c74998981185aa16
MD5 74e0a4931bfa98e975ebfc83a1407289
SHA1 62247136d744ce7f717864cb7505e4492d996cc9
SHA512 652b0cede2070dee390945db6d974fe0a0bdc78b3b52a3d1d0b6d3f862d7246f411492bea93d821c968a93937e992e6807829d5f0995c19a359941aaa04144ac
SSDEEP 96:1Jw6ON4OUZaTPCYaIENV7Bq0RotcYr6GA4wp03sdI6ddJdW3pYSXxoD1Qmsz0KiE:1JTzaVYY/9AgGIUnW3emxoD1QmsRPlR
TLSH
T1A4123F5D76B90CBE2ADBE29C98820B8D83DC474380C31DC74D97CE098C9EB5A361E536
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\extensions.json
Size 16KB
SHA256 ceec1bc0ef31721ca11985133b058408eb85fbbbf89bd70c3955b7dab83c38a6
MD5 df749c9bb4c4b194a34d794a1058e584
SHA1 13206528229323dcfd6f6086f1cf61d5da81729c
SHA512 9358771f8777b01430651faa12cb3a645fc677d02ed5aeb43c7f064c5fbc47a43d331c24dc670dcb9dd0d26eb73000b041890f0eee67fd78e8cda534bfee9582
SSDEEP 384:CkI4vDUmldvG8dhWa94zY96oRL4H5L4P1L4HtQL4HVL4HAP4hq:1I47RfrXX4Y6y4R494NS414C4w
TLSH
T17C72521545148EB8298FA79BAA367E01C37D433B60855C78F4DD8FC802FA5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\gmp-widevinecdm\4.10.2934.0\manifest.json
Size 1001B
SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
MD5 580786a5ec9eb650dde3e0e75db8588a
SHA1 8c0835d1a6bf82e753b624440e9674d649696ead
SHA512 c8d41e16b291157e2afbf978469eae4c017d1ce3b941b93ae710e2bbaaf4c3e601db45e579d22b957b7a1ec48cba788015725a2fa23cf02f2d66010ef4fdd0a0
TLSH
T100115B10DD388D9326E4BAA21CC6580957661DAF4CC23F98379E161D8F1C8AFA37366C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\gmp-widevinecdm\4.10.2934.0\widevinecdm.dll
Size 18.9MB
SHA256 875a76af5b19622842c9b37fe77dce10ee83f27adbdcfcde9c814d4e1226d023
MD5 15fa9ea03f6f451d587b1dabb2f7b036
SHA1 a1a5cf60b693f732931f8e7512627d2840023dee
SHA512 8d5e5aa0a116bb09dd492b6b59bcd9458ded013e6b52a31dd36e81313c3f2d9ea01d5bf3ec4b0f2593633a5313705af773a4e7245d6cfd96f231332db26d75ae
SSDEEP 393216:uD9xOHbGD+l8Vm148M/i5hE4/junbj0OjLFI/USFUzUqr1d4Pg4C5/:tGD+l8VmuZ/S24/junfSFwUqYg4A
TLSH
T13717E149E36310E8E80E89F446AADA72D4743C4E03369BEF17D4BB3559727C06A79F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\prefs-1.js
Size 12KB
SHA256 18c16f44d1ec716d3e3244f9b0cc68677a38a133984878280cf4378a0d0f93c6
MD5 1e4f7a387db9a4b9ecc00776d75c9c99
SHA1 2df80c33fb6604f6e8ffc637eeac00f7e9ce42bc
SHA512 13f8b749aed034e9ecaba9d63a0587806bb39293c7da48c1c0c5bb24a0c7a063eb7c4a41b19dee1c7aae78c1d6fc7e7f3119fb529c902699ebee6f9e06d71f79
SSDEEP 192:U7CCRvfHix0SS/LRyaYzMI+mBw88O327MrYC:ibRqDtwEnj
TLSH
T14E42A97C5044CA7F31BA327D6C694DB21A610137B6BFBCD242F898810C5CF6845EAAE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\prefs-1.js
Size 8KB
SHA256 c777882a2fcbb5f256980ad7b8a82880fdcd7ed94c489e2a0ecda08d907ade0f
MD5 636d0e9f70ec1133732e74f58d01c551
SHA1 15828ad810d9cb127f143718c23ee540f5482ee7
SHA512 05d9b15aa29879688e10748242543e548464a4258bc168ea7bda8dfbb7e143696aa70edbbbd1eb55114869d3adb19ef23e6c1667fc895e15eec8ffcd2ebda5a7
SSDEEP 96:xHiRTUAPqGqcUfHixNbzSaSSlrdv9j3nHWRz+riDYzM7Bw88DtX8L4cnHVjkGS:U7CRvfHixLSSURyaYzM7Bw88DtaM
TLSH
T1A4021D785008CF7F75BA367CAC684D715A62013BB6BF68C250F95884095CF3845F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\prefs.js
Size 6KB
SHA256 be23e782bb25642071f282d97a8371eed7d01942de7c51a0d01c104e58539040
MD5 994e291078449c69de63e8a5c50cc220
SHA1 681a623896f5e90167c41b5c074f979d0278f631
SHA512 d45b06f49043bcbc5b076eaac9d50b44470c8de5977ae4c8feba670e6639c13292115b85933a7058780b23c14731dfa5a28a3cf4403b1f768ba1bc8053f08dcc
SSDEEP 96:xHiUTUAPqGqcUfCKjKnjs1zSMSSlrdv9j8nHHCriDYzMgBw88H8L4cnHVjZ:UwCRvfCNg9SSqCaYzMgBw88qL
TLSH
T1BFE12E7894088F7F74B6776CAC6888316AB2413BB7BF68C750B95484054CF3842F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\prefs.js
Size 12KB
SHA256 ca73c49c8785beb0c52bfe794c4cc79fadf28f47b35cebf3b3cfbd585367d2a0
MD5 146b8af57a6f0097dcdc9a579c67b394
SHA1 8bff74bfde462b513c4043dc5658670bfed56986
SHA512 89d6e9b6a11764c1c5b420df50432e27d2e640a01bc0199561d3d82b2a2dbd1ea3ea0bdd484966bfb99e512295dc865735ae946d178f79f07701570244e8a476
SSDEEP 192:U7CCRvfHixLSS/LRyaYzMI+mBw88O327MrYC:iSRqDtwEnj
TLSH
T13F42A97C5044CA7F31BA327D6C694DB21A610137B6BFBCD242F898810C5CF6845EAAE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\prefs.js
Size 6KB
SHA256 7d350340b82b58ef48bf93a54645b43ebca7750572bde731860ae6f9a5b63af7
MD5 3dd36f7548bafe269120dba617fdfb1d
SHA1 d4a9eca5fbacff68b3b0835acfbf13f30c20e37b
SHA512 419e82b975ca8bb8bf018d182abd417e25d202a631e77af65d14ad2a4c2392132b67c014b9c5caaf128490d50966118c4248de2badf374a03b10c42d2623c809
SSDEEP 96:xHiUTUAPqGqcUfCix1zSaSSlrdv9j3nHHCriDYzMgBw88H8L4cnHVjZ:UwCRvfCixPSSlCaYzMgBw88qL
TLSH
T13EE12E7894088F7F74B6776CAC688C316AB2413BB7BF68C650B95484054CF3842F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\sessionstore-backups\recovery.baklz4
Size 2KB
SHA256 f8ff33590877d32de1ffe56cfd618c2b54eebd12c85042d4bcb992dd56ed20bc
MD5 d22ff9640164a1fcb10c6ee5b5846a6c
SHA1 26c9efc38e33aa53f74fc7b35a802f3f8df72987
SHA512 d6a4c7b70cf7cd699dc59c900b11f6f2f01dcaffc0defe8565a561f7abece5c0d9252d0493aaea37d0321084fb4dbbb75acd5147a635ea4ac68da0f2292e280f
TLSH
T150515DA71C2B6CFB7925C2B964EF0FD18A53241044F554A8BE68A91101FC6056AC5B5F
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\sessionstore-backups\recovery.baklz4
Size 19KB
SHA256 3169f2a33f0d880e3349a78deeaa3b2c76a97b7b24bae979a3dcbde322f5be2b
MD5 ab8540526daa5f17178159c22c3aaacb
SHA1 8fb5019dfd4511eee0a2dd48239baa678c35d49b
SHA512 8a92cc34f0c38319133572dcb253543d7e778e6998ec8530478b783df965067cd7007fa0b1e0acd7481d676d4a19335dff5fc76f9903bf49003c0d81f5045bbb
SSDEEP 384:Hh9UZ3Xf9T7daL0y5WnzQ45zPCrhh4GHWVGDkPH3zmdvPCaEGRQ:s3XfNdEt5Wz9wSVmkbmJCaW
TLSH
T17D92D0256A2580D34611EF2984B60D3551F79C0787C16B6CBB2BB97F0BF8FBA392D448
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\sessionstore-backups\recovery.baklz4
Size 39KB
SHA256 f17be7d28631632193cdcc68798325d7b552d2ff061020026992446802cc79fc
MD5 31150be32fe4b6a9c20ed9fcec9ece52
SHA1 86f64fe79c00c2cb2809de00f03cd5d742fe23fb
SHA512 560a23932b2c7b0ca903f9ff3cdd277f00d1b632548dc9fded1febb2c25c931bf67028f5487301d9fb97b51878f9d1fdf96fd21ebbe6fc620dacf0a35c096ed9
SSDEEP 768:kwDGNdEtscKB3Ug3ZanLuPJr3ckRDrPFxWT7m44jMAoVqkiuS38zg:7add3Ug3Un6JbcyWuNQAbuS38U
TLSH
T14403E13A015730ED18AC9AA152160E3A4DF05F4BC6940AAC976EF4A54B79D38B6FF03D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\sessionstore-backups\recovery.baklz4
Size 41KB
SHA256 9d77a0efcabe511fac230e888321287f32e5a651b0677a9fe9ecbe1440ae6edb
MD5 baa8bd6f375132285982f798f3a71ec4
SHA1 cf7e4ce427074e5e1717d6787ef6ca875065f6fa
SHA512 2a764355e33bfa756e5c66e0ee056d1403cf02f99f2b3d0a63f82f2afb207d1b7e27c43b7de087b1a4e64f1667f9d9d5ea4750bc95bf8ff234c8f702d2af2a96
SSDEEP 768:GNwGdEtMeSWcH9T4g3ZanLuPJr3ckRDrPFWarYm44jMAoVqkiuS38zbY:GXdasT4g3Un6Jbc7ajNQAbuS383Y
TLSH
T1B913E1394227309D156CAE9192030A2B4DF46F0BC6941E5CA76EB0628779D387BBF47C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\sessionstore-backups\recovery.baklz4
Size 16KB
SHA256 e6cdaacb52d4b0a7d0e78c89e001ee0d56484e83b2ad7b07f2da21c34ad76884
MD5 d97a6fa9f2d6047fbc1d291409fae0aa
SHA1 02f27a307c8cb466a6d3a81f36bd1e8ef89f1c82
SHA512 ea639fa9b01ae7154990f9cb4b355f4ee97f293fa77e15c7a438e10ea1ea3b2398756b21bccfc26d85681fd1e786dbd9fb61c3233b62b7d5662ca10a97f13e1c
SSDEEP 384:GTwT7daL0yQx55zPCrhh4GHWVGDkPH3zmdvPCaSa:vdEtuwSVmkbmJCav
TLSH
T14672D0142B1A40D75910FB29C1F70D395266CD87EBC52FBCE22B79AA477CF293929408
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\sessionstore-backups\recovery.baklz4
Size 46KB
SHA256 e09d7b7edd47a93f7c8d1935057bf563d143dac628b8a38d7b390002c794dce5
MD5 e2e3d7e3b60b6df935cab7e8e0481796
SHA1 f5f8ab447299e0b1eba9257838122aeb3a6d22d9
SHA512 81efbf619c96050d28d626d981c4e46e1aaf75d4410307f6fc721badce86177f5e5f14bbee3c4daa231f606bca6b10adeb317ceb85d72f7f91e44d75d0825eae
SSDEEP 768:TlaZ1gLMzedEtr6S+rJ7g3ZanLuPJr3ckRDrPFOaHMy44jMAoVqkiuS38zV:TAZKdlvJ7g3Un6Jbc7atNQAbuS38p
TLSH
T1A923E02A4227309D146C6AA2A5070A2E4EF06F07C5C55E5CDB5DB05A8B75C38BBBF83C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\sessionstore-backups\recovery.baklz4
Size 36KB
SHA256 aac31e344c5791d4981553a18999f259fb78de422455c064275b6839c48bd8af
MD5 4d305158f9ed06ccdd0215c9498986b4
SHA1 5d7a510fff5cf306a4cd8fac82dddfc29bc2917f
SHA512 b17639d8921a7217b18893867a43e439135fdfbc9039faca06c623ccfdee241201695aec0b30e17089ec60b690d81f520762c546447bca91793377b98f004f2d
SSDEEP 768:H+dEtzKNcJXg3ZanLuPJr3ckRDrPFTWX44jMAoVqkiuS38zO:edJNOXg3Un6JbcuWXNQAbuS38K
TLSH
T1DDF2E12E012370DE08AD4A6152120E2A49F45F5BC6850BECA76DB4768B7DD3CBAFF01D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\sessionstore-backups\recovery.baklz4
Size 40KB
SHA256 83ee72b406052ad5a67bb84f44923e7d39d23a679f48c72da9f831e810d02cd0
MD5 05de815c783f7b68ffe0161ed5540973
SHA1 7f83a1b51f4336f5df2462ae24c2d85caabf81a2
SHA512 d3c7fa1a64ac085b084152ca630e676d7b10216d63a22005e072c64f58d82f65abfc62427468bcfb22520e205abbc9f9628150f8dbe769e80d25311ba2812b4f
SSDEEP 768:VwDgrdEt7SPmJCMg3ZanLuPJr3ckRDrPFta5+m44jMAoVqkiuS38z0Y:mKdwjCMg3Un6JbcKaDNQAbuS38gY
TLSH
T10213E139026730AD086C9A9151060E6B4DF05F4BD6941F6C976DF4714B79D38BAFF02D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\sessionstore-backups\recovery.baklz4
Size 42KB
SHA256 1d029b7046b0acd59e54a8a8fd056d42d55d82b9c48981f6c927fb4063ffc676
MD5 8afee2775b3479c0c8c5ec2e857585f7
SHA1 2b0649d516c2f069898cb53849991beef99c5a82
SHA512 58cdbbacdc3b870db41a8b2ea52ed1689bbb52bf1ee9eb48fe611b3922ecef4f0c5af4f49d9b7ce24437d15c0931e2dca9551f10debe12355c5b2ffbca890d04
SSDEEP 768:CNoVYdEtdjS2c9oJ4g3ZanLuPJr3ckRDrPFOarYm44jMAoVqkiuS38zZ:Cpd6nJ4g3Un6Jbc7ajNQAbuS38F
TLSH
T1D913F1390217309D146CAE9196130E1B4DF42F0BC5905A5CAB6EF0A68779D38BBBF47C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\sessionstore-backups\recovery.baklz4
Size 47KB
SHA256 d512c592f5be1a9e3ecf60c81c96cdb47653719f6a4a5d5ae8749abb733410b8
MD5 c31b63dc872ba24bc8da715511cdd71a
SHA1 d6e4f7e83bafb2f58ff02c51460b550682c739f4
SHA512 b14ee5925ce96392215d319605b86441224a5e2df8a16e15a547c909f5a1263b638acf1f8e78829bfc2b3dcc8fa886c2aba67cf3ffaf6455018c778deef11fc2
SSDEEP 768:9M/Z1gVzgdEtrzS+rJ7g3ZanLuPJr3ckRDrPFOaHMy44jMAoVqkiuS38zj:96Z/dcvJ7g3Un6Jbc7atNQAbuS38H
TLSH
T18D23F12A4217308E147C59A2A5070A2E4EF06F0BC4C55E5CDB5DB096CB79C38BBBB97C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionstore.jsonlz4.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\sessionstore.jsonlz4.tmp
Size 47KB
SHA256 d3ede43ce456b38376193c301e0e3ce08846c4970a0552b6cd17fe3b1279f933
MD5 300508a93eedbe21546c27c0e65b2f6b
SHA1 45decfc824d535b68612b0164646b8f24ad95ea1
SHA512 f157bfa96add0b627abef36a39db1fd9687c6e16f62819c626e05d7064985d2bf29abfeb16de71ac9f6c3bdd6729d2fd7379b553b9102419be517ab6b7fac125
SSDEEP 768:kH/Z1gVzgdEtrzS+rJ7g3ZanLuPJr3ckRDrPFOaHMy44jMAoVqkiuS38zU:kfZ/dcvJ7g3Un6Jbc7atNQAbuS384
TLSH
T1AF23F12A4217309E046C59A266070A2F4EF06F0BC5C54E5CDB5DB096CB79D38BBBB97C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 3.3MB
SHA256 19cdd05b4e0a65d595cff9cad37dd7a76962574713a44ea7f5eb27c850c2a75f
MD5 60acd3225ea4d0c4759386cd47a56fa0
SHA1 2af9b4d69dd0d6314591a8f76f75f41268c75f40
SHA512 7809e4b490648a101cc97653f20eafb82e4ad6fade6687336a66bb624e12b822086fb37bf0518d5edee05a8987efdba3ad2309b87288c52e59a57a29e78a1688
SSDEEP 24576:dCW++tIdfnUarz63BDcYrVQpQ9pyi9P28lQyzH:djUvUs6pcYrVEQ9p39P2+Qyz
TLSH
T14AF53BF820D2B357F3418033A64593EB21AFD00C6467DE044BA956E895B9CEF9E05B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Manifest.ini

Path C:\Users\Admin\Downloads\Gravethorn.Build.22790733\Gravethorn.Build.22790733\Engine\Saved\Config\Windows\Manifest.ini
Size 25B
SHA256 531bfb7088f544a87ff1268a69a3648dc0648ba49aaca9c3c67d4c4dcf87f088
MD5 06f8eb26d5a03adde30f5419350a8cef
SHA1 b1e6d0cda51fc9d88852d5dea33f7d793c1d3beb
SHA512 62623c6fd565a9305f518cf7bad4e26388a80d007ea2b80fe83a2c0e0d5835f1990c677c6c3e778b0ff48c6a8dc4b32618dc3343289e0c766ade3ef19e640375
MD5 SHA1 SHA512

Submit Download

steam_appid.txt

Path C:\Users\Admin\Downloads\Gravethorn.Build.22790733\Gravethorn.Build.22790733\Gravethorn\Binaries\Win64\steam_appid.txt
Size 7B
SHA256 9b5ce5e7a5431a001eeba489069b58e693105ecd06f5fac4d6d6dca1b0f3ac1b
MD5 0b73089f83e7af9557352b3342d24f7d
SHA1 72ad57a2e578a7dbedd7d97c5342ee128d52747b
SHA512 8503f30e9c6d7ea9ea9b604676ed90cf656d3d62de0c2fd7944814d98b66d7328f5b58c9cd6f30815210e3714e57c0bb185acbe8c025b4e46b79eb1366e88812
MD5 SHA1 SHA512

Submit Download

Gravethorn.log

Path C:\Users\Admin\Downloads\Gravethorn.Build.22790733\Gravethorn.Build.22790733\Gravethorn\Saved\Logs\Gravethorn.log
Size 353B
SHA256 1b8d2cea53ddab19be5ca8eff1b64aa474ed3ffa418aabefe18b4c4491861c65
MD5 86d79a7dc627ed086e03ae80abc1093d
SHA1 3cca82d3b33a57085d114ac481f8f741aa21ad7a
SHA512 11d83335ca29b0f99b5af29da98a5a6b61b28d914c05861a7e1dc90078d1e449c04ca1a026dd3caa6447db1948ec763cf80cbbe478b07e2845007bbafca6919b
TLSH
T1E2E06F1009684853D6702033EBED9220280A4CBF0B226AAC0A482218EB8168B38E72C2
MD5 SHA1 SHA512 TLSH

Submit Download

OperaGXSetup(1).exe

Path C:\Users\Admin\Downloads\OperaGXSetup(1).exe
Size 3.9MB
SHA256 84bb2046b2a3dbca3ebf449aa38a58cafdbf55f1c502d864dae4c45c38ea76c4
MD5 58b5ead3d3ab0da0a70e6694b08a5094
SHA1 4d930471278a09bcf337d71f330275072ae2398b
SHA512 a460b50a698340e1dc75b3ef156cf96f024bd41d42cc9d2aadf5d2282ecdc0e0b38ed75e14a9c63ceb1be3576b1ff093e73b85a1c395398d997b13b6f5b81da9
SSDEEP 98304:BAiuN0V0ZhWQ7LepW4ghq6ZrWecBcG4uK7b:A0VeWQLrhX1Wxab
TLSH
T1E91633217B80D033D2A315325FA9E76D97BEB6691E22425B67C80E0DDF32941BE35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperaGXSetup.kprIEXwl.exe.part

Path C:\Users\Admin\Downloads\OperaGXSetup.kprIEXwl.exe.part
Size 3.9MB
SHA256 7f29a42e7f8321c4ea9b12ce59dd98e906f09697866eb4dd8e94d3bbfdb5f11f
MD5 776107cb37f6117509f3418194927682
SHA1 170fc66bc2bde4bedb7ddc9edb9ef9a957c3ad5c
SHA512 ba028aff612fca3894604aef30b97b5a181ea23c7fc48da353a448b6d831bac8da6fe37666826886d404982f2a124c01cb19fcbf018cf8c9ee1b1d12168ab8f0
SSDEEP 98304:VAiuN0V0ZhWQ7LepW4ghq6ZrWecBcG4uK7D:k0VeWQLrhX1WxaD
TLSH
T1021633217B80E033D2A315325F69E76D97BEB6691E22425B67C80E0DDF32941BE35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1532-2482-0x000001E9A0530000-0x000001E9A058D000-memory.dmp

Download

memory/1532-2483-0x000001E9A79C0000-0x000001E9A79C9000-memory.dmp

Download

memory/2692-0-0x0000016213C50000-0x0000016213CAD000-memory.dmp

Download

memory/3712-2416-0x000001EB23700000-0x000001EB2375D000-memory.dmp

Download

memory/6440-2419-0x00007FFB2E220000-0x00007FFB2E230000-memory.dmp

Download

memory/6440-2429-0x0000018E696F0000-0x0000018E696F1000-memory.dmp

Download

memory/6440-2428-0x0000018E696F0000-0x0000018E696F1000-memory.dmp

Download

memory/6440-2427-0x0000018E696F0000-0x0000018E696F1000-memory.dmp

Download

memory/6440-2447-0x0000018E5E920000-0x0000018E5E97D000-memory.dmp

Download

memory/6440-2448-0x0000018E65DE0000-0x0000018E65DE9000-memory.dmp

Download

memory/6440-2430-0x0000018E696F0000-0x0000018E696F1000-memory.dmp

Download

memory/6440-2431-0x0000018E696F0000-0x0000018E696F1000-memory.dmp

Download

memory/6440-2432-0x0000018E696F0000-0x0000018E696F1000-memory.dmp

Download

memory/6440-2433-0x0000018E696F0000-0x0000018E696F1000-memory.dmp

Download

memory/6440-2421-0x0000018E696F0000-0x0000018E696F1000-memory.dmp

Download

memory/6440-2422-0x0000018E696F0000-0x0000018E696F1000-memory.dmp

Download

memory/6440-2423-0x0000018E696F0000-0x0000018E696F1000-memory.dmp

Download

memory/9180-2315-0x000002956C560000-0x000002956C5BD000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads