436e791e379f21c0dc55597e739466158cd343fab9da528d1b5b586518268cd7

Resubmissions

08/07/2026, 09:38

260708-ll6neady6z10

08/07/2026, 09:37

260708-llngtsey6r5

08/07/2026, 07:19

260708-h5pbpadt2k5

Analysis

user interaction
yes
max time kernel
127s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/07/2026, 07:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
nvml.dll
Size 327KB
Sample260708-h5pbpadt2k
SHA256 436e791e379f21c0dc55597e739466158cd343fab9da528d1b5b586518268cd7
MD5 cfa9492129a8b3e4e859097de41f6d58
SHA1 2373c7d4df16cb28bb626f8d52ab3887690ed08a
SHA512 612f32aeb4fa0c85139ed3d31181bcc7943cd825b51c6f87e8cf3a335b1a7e77e8b2f76cfff1c2111402d409f97299b165edc00f8d4d2bd6a8990f647964c409
SSDEEP 6144:p3n7CamhS+OKnkh2TKVu7Hy6iZl2jP/PMDvqmbKHszHev3wwUut9tlbqqqG:FCPYSkEuZlyjMD17H03wbuHx
TLSH
T1CF647C50B251FEB5DC8A8FB421E22349D3E6B041971DB93F6A20FF3C025EA68D573A45
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

persistence ransomware

Malware Config

Signatures

Checks processor information in registry 2 TTPs 22 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings	OpenWith.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1960	NOTEPAD.EXE

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3068	firefox.exe
Token: SeDebugPrivilege	3068	firefox.exe
Token: SeDebugPrivilege	3068	firefox.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe

Suspicious use of SetWindowsHookEx 30 IoCs

pid	Process
716	OpenWith.exe
716	OpenWith.exe
716	OpenWith.exe
716	OpenWith.exe
716	OpenWith.exe
716	OpenWith.exe
716	OpenWith.exe
716	OpenWith.exe
716	OpenWith.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
2532	OpenWith.exe
2532	OpenWith.exe
2532	OpenWith.exe
2532	OpenWith.exe
2532	OpenWith.exe
2532	OpenWith.exe
2532	OpenWith.exe
2532	OpenWith.exe
2532	OpenWith.exe
2532	OpenWith.exe
2532	OpenWith.exe
2532	OpenWith.exe
2532	OpenWith.exe
2532	OpenWith.exe
2532	OpenWith.exe
2532	OpenWith.exe
2532	OpenWith.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 716 wrote to memory of 2024	716	OpenWith.exe	95
PID 2024 wrote to memory of 3068	2024	firefox.exe	97
PID 2024 wrote to memory of 3068	2024	firefox.exe	97
PID 3068 wrote to memory of 4152	3068	firefox.exe	98
PID 3068 wrote to memory of 4152	3068	firefox.exe	98
PID 3068 wrote to memory of 4152	3068	firefox.exe	98
PID 3068 wrote to memory of 1696	3068	firefox.exe	99
PID 3068 wrote to memory of 1696	3068	firefox.exe	99
PID 3068 wrote to memory of 1696	3068	firefox.exe	99
PID 3068 wrote to memory of 1696	3068	firefox.exe	99
PID 3068 wrote to memory of 2012	3068	firefox.exe	100
PID 3068 wrote to memory of 2012	3068	firefox.exe	100
PID 3068 wrote to memory of 2012	3068	firefox.exe	100
PID 3068 wrote to memory of 2012	3068	firefox.exe	100
PID 3068 wrote to memory of 1064	3068	firefox.exe	101
PID 3068 wrote to memory of 1064	3068	firefox.exe	101
PID 3068 wrote to memory of 1064	3068	firefox.exe	101
PID 3068 wrote to memory of 3812	3068	firefox.exe	102
PID 3068 wrote to memory of 3812	3068	firefox.exe	102
PID 3068 wrote to memory of 3812	3068	firefox.exe	102
PID 3068 wrote to memory of 3812	3068	firefox.exe	102
PID 3068 wrote to memory of 5564	3068	firefox.exe	103
PID 3068 wrote to memory of 5564	3068	firefox.exe	103
PID 3068 wrote to memory of 5564	3068	firefox.exe	103
PID 3068 wrote to memory of 5564	3068	firefox.exe	103
PID 3068 wrote to memory of 5580	3068	firefox.exe	104
PID 3068 wrote to memory of 5580	3068	firefox.exe	104
PID 3068 wrote to memory of 5580	3068	firefox.exe	104
PID 3068 wrote to memory of 5580	3068	firefox.exe	104
PID 3068 wrote to memory of 5588	3068	firefox.exe	105
PID 3068 wrote to memory of 5588	3068	firefox.exe	105
PID 3068 wrote to memory of 5588	3068	firefox.exe	105
PID 3068 wrote to memory of 5588	3068	firefox.exe	105
PID 3068 wrote to memory of 5600	3068	firefox.exe	106
PID 3068 wrote to memory of 5600	3068	firefox.exe	106
PID 3068 wrote to memory of 5600	3068	firefox.exe	106
PID 3068 wrote to memory of 5600	3068	firefox.exe	106
PID 2532 wrote to memory of 1960	2532	OpenWith.exe	112

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\nvml.dll,#1
1⤵
PID:1296

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:624

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:716
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\nvml.dll"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2024
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Local\Temp\nvml.dll
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3068
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2004 -prefsLen 27099 -prefMapHandle 2008 -prefMapSize 270279 -ipcHandle 2084 -initialChannelId {0440171b-e137-48fd-91ad-069432d1e045} -parentPid 3068 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3068" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:4152
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2496 -prefsLen 27135 -prefMapHandle 2500 -prefMapSize 270279 -ipcHandle 2508 -initialChannelId {c1a2b6d4-3227-4a31-8910-0539fd479bd5} -parentPid 3068 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3068" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      Checks processor information in registry
      PID:1696
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3852 -prefsLen 27276 -prefMapHandle 3856 -prefMapSize 270279 -jsInitHandle 3860 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3868 -initialChannelId {037964c4-4357-479c-91ae-7c3b22ef25e1} -parentPid 3068 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3068" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Checks processor information in registry
      PID:2012
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3996 -prefsLen 27276 -prefMapHandle 4000 -prefMapSize 270279 -ipcHandle 2896 -initialChannelId {fda5d42c-d5cf-4055-82e9-dce60012c2fe} -parentPid 3068 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3068" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:1064
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3768 -prefsLen 34775 -prefMapHandle 3808 -prefMapSize 270279 -jsInitHandle 3812 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4388 -initialChannelId {0d35c436-928d-44cb-86b9-0ed3de3f15e6} -parentPid 3068 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3068" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      Checks processor information in registry
      PID:3812
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 2952 -prefsLen 35012 -prefMapHandle 2796 -prefMapSize 270279 -ipcHandle 2800 -initialChannelId {9fee1f8b-f799-4d2b-9d35-d05d589503b3} -parentPid 3068 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3068" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      Checks processor information in registry
      PID:5564
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5168 -prefsLen 32900 -prefMapHandle 5172 -prefMapSize 270279 -jsInitHandle 5176 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5188 -initialChannelId {ee83ead2-4d3b-40cf-9f6a-a74819858d3f} -parentPid 3068 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3068" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:5580
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5292 -prefsLen 32900 -prefMapHandle 5296 -prefMapSize 270279 -jsInitHandle 5300 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5308 -initialChannelId {d2fe0cb9-7ba0-406b-b497-798d440f7a12} -parentPid 3068 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3068" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:5588
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5688 -prefsLen 32952 -prefMapHandle 5692 -prefMapSize 270279 -jsInitHandle 5696 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5176 -initialChannelId {7cff01d2-d753-414c-8e66-f3fe8082079a} -parentPid 3068 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3068" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      Checks processor information in registry
      PID:5600

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\nvml.dll
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1960

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 4588fef446607afb37cc299940275ec3bfd7db51693607c1667114554e22631b
MD5 5c0e9f0cd26a728f44c1726fca2b4481
SHA1 e2827df2a574511bfbd9ad5fed5ad86e6195045b
SHA512 488836331e73688824355709c0f4352a8767a78be689b399ed4a549b81e11065660686a66a1e9cc752518c4ced059723a36d60cc6f48049bc4cb66be8b9883d2
SSDEEP 192:RYImxH1d66JozGzgCl6mc0dqOv5zbowbmlyjQyC:IHd66JozGzgC1jTbowbmlyja
TLSH
T179D12EA4F628863FC405523BCCA60F054F35396B984E3F1932DD610C2D5A6DE768E17D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 c61da8da50bc56388d4d2580f90fac023c9d3d14c2ad78eda4a5e033bf3310bf
MD5 6e3945d87ebc5e8eba0494553d445a63
SHA1 838ebf60fd691928b71b45e25206503e9fdcf9db
SHA512 a99015aac58e61f8f47bfc401ecf49dfbd065f59db110598bdaec9b1cd98239c014ee5b11f34a66652259c065d18879993752b0a6488200c01505f68115baf1e
SSDEEP 192:uYImxH1d66JozGzgCl6mc0dyOv5zboPzFZmlyjQyC:lHd66JozGzgC1jvbo5Zmlyja
TLSH
T1F4E13EA8F628823FC408127BCCA61F444F3539AA984E3F1932DD611C2D576DE768E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\datareporting\glean\events\events
Size 1KB
SHA256 2a111c69587e38902f2406f313cbe0235d7466b35fb6ba49d24e5864ce894f92
MD5 d8b8edc09a989beab3fdf10c0585988a
SHA1 eba23265652f17a3744fe277388358cc94575ef4
SHA512 fbef23169d2720132e3abf283abb5d01c306d019fa7a8d80f7cdea7a44db39ca6169b0f8adb61fdf28d271e72809f873f7d326c68524ce1d61e988f8528fdb5d
TLSH
T12F212C5C39F98D6A9DCBE2AC7451038E93914E0705871C474D82FECDDE856DE326A83D
MD5 SHA1 SHA512 TLSH

Submit Download

29a54b58-220b-47e0-aeea-355f7e1de93a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\datareporting\glean\pending_pings\29a54b58-220b-47e0-aeea-355f7e1de93a
Size 2KB
SHA256 2ee502427e5cd7dfaa074b6f058cadf35722d59155d0ee3a6a340c7d4fbad228
MD5 c016e18451d95c3b70e547344a4c20d8
SHA1 80b688d3f3397fbc105bf53ff303ecff2ff5f82d
SHA512 00817b34c566d50e9685385e22442567181f1fbf95e34420eaecfe10974848208c1e12f5c998db8c6c2f8a0bdf3a50da43effca97553053419767071867935ed
TLSH
T1E141215C35785CB79CEAE1DDD482278E43B48E0310C61C432E52EF0C9C96A9A336F13A
MD5 SHA1 SHA512 TLSH

Submit Download

545ac773-bd81-466f-9313-573defe8dea0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\datareporting\glean\pending_pings\545ac773-bd81-466f-9313-573defe8dea0
Size 235B
SHA256 14e50f3bbbfd8cb766dadb35cd11266ad45dcc5c2a0fb2b3c7c48ffa67f54e31
MD5 04e514e72ab951d5a63a0bb7a530c8f9
SHA1 5e1ac8ff2a2c8da77d9a32afd33e1903212d2c06
SHA512 1ba9f42a71ff18491570aa92b5cc13e231a78c9b940f23f6ce88b9be44f188b3c3afadd3e383f3b3917ebd407f22ddf55c7604dc26bc6393037c7af67eb70f9d
TLSH
T11AD0238034AC3F3C48240F03F4E02BC27089DC3368716810E95189389DFDEC84151C6F
MD5 SHA1 SHA512 TLSH

Submit Download

5c5b0f0b-bd58-4fd8-9ba6-fb9313e335e9

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\datareporting\glean\pending_pings\5c5b0f0b-bd58-4fd8-9ba6-fb9313e335e9
Size 886B
SHA256 8dcd02a2c9f845f8dcd728fa3c2a87aadd86102d8f51b4a8e0481cc4f94442f1
MD5 bcf246628d367eda489da709d1a7a465
SHA1 73b599d32b5b28686ca553f0c79d7f6b67369a20
SHA512 99e78e549b2b6af6e01220caef90698bbf750059992fdbd2dc02a1c76578b09b2ba2e17392e4f3d0f745ec21313c3a07c530ce22e66a67b9f16658c3c172b889
TLSH
T1D0112380963975729C68E29B88A53742C7F0B92380C51D087E9117280EFA91FA76B70B
MD5 SHA1 SHA512 TLSH

Submit Download

962e2e36-a814-4cfa-9565-3fcc999b62cd

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\datareporting\glean\pending_pings\962e2e36-a814-4cfa-9565-3fcc999b62cd
Size 235B
SHA256 c489ab7eb6cf71d945bff67ef5b7106df6ecb2e2a4ceee60b6e222a7ed84040d
MD5 511e17bb429bf3a0de72883461ed42e5
SHA1 64bd639dc08ba56601f6d2ae93381a764d522d8f
SHA512 b93e09808b2151d80ad096a6ebd63d0725eff9284ee81fbb0bfce23a874121b630e8f6c6228d035012a099558411668e897703c9b9b66329090439f44ec135c1
TLSH
T130D0978018D82B9D48000F17F0E028C230444C331179A824AA6245348AF9DC502A2C1B
MD5 SHA1 SHA512 TLSH

Submit Download

a3b590fb-e5c9-40ed-8a6f-8a91ba8ef71d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\datareporting\glean\pending_pings\a3b590fb-e5c9-40ed-8a6f-8a91ba8ef71d
Size 16KB
SHA256 a3651d270050b3bea4923cba990259ab8fac82517fc278df55333c2f0caaa01b
MD5 e3240c44291fa32cfa262cdd026b49cd
SHA1 04d49c4d05041f86596730b2284d5263d17e5722
SHA512 587529dac9aad272137e06d43cf386c19e3607d792125263e6605ace05639c504ccaaf2ea9ab313d8474cf67b8e688538d06bf784a4370e85b956330741151ed
SSDEEP 192:iYT1iQzVOI7DvXcaNRTaDrGwi6yh59+73H8y4FBoue11zGDUBeGfP/HHCibAzuSJ:P1iQBOI7Dn1HyMUlfXnCibcZmuPZw3m7
TLSH
T11F72C856686045BA8251E768D4FC7FC3E6F52CCF4C418FCADBE4BE0869DA06E112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ed080874-5455-497a-9f41-7dcc1185a468

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\datareporting\glean\pending_pings\ed080874-5455-497a-9f41-7dcc1185a468
Size 883B
SHA256 61111d722b7133fb73d467a7446aecc962d83ad98bce9922ebbcf9b4baadda8e
MD5 c22ac24b054787b5d7ea91af9b1dbfe3
SHA1 ac9b3015b1e32c2edbcea077db0e02c337cf8402
SHA512 b0849d34c343e794cfc5978404e797f46277c5d668ff03194a06e33728805ebf03bbe44b89e7a9e329a62fedfb56686f09305c205b1f70c29c94ae69ce938a9b
TLSH
T14611E7C1E63574B3DCA8D25FC99537018BF47A2380C549147DE157190D79E1E536B307
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\prefs-1.js
Size 6KB
SHA256 2de532722136e3ac2be51ff94f14ae0498a56abce17aa40751c06fb60b972cb6
MD5 84ec4a5b30ee14999379fd1edf219be3
SHA1 98dfa3fe9f1e1d19d100c2c596dcb07a811145d9
SHA512 c5403120ab0a718ba399b0dd26d8b120a33b5b40394a547af28d605a5d5144a421fcd9be45ef64fd10aa98dab77718d765f2828e3ea409e21343326d36943015
SSDEEP 96:xHBUTUxwPqGq5fgIX1zSVtSSlWdv9jFnqH/8MBw88n8L4cn+ssGC:HSCR5fgIXYtSSldBw88gC
TLSH
T1A6E11F789518CB7F64B676BCAC688D715AB2013B77BF28C610BA54C4051CF3841F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\prefs.js
Size 6KB
SHA256 b27bcd567c0aeabb8e8e33c91062715f0f36f06db59414391328bb5bfae6f619
MD5 435d15b698a8e54672858dfca559fa16
SHA1 f941eb5c27071a4ca91181a5a027ab92e041b5b8
SHA512 ebec505a5c486041b2fb5de37320b8189bcb862ec5496119e7a60740c13ec923e23a29a55ed9d4e3ac9d6f15359f8fc11e4b91aec393648fa196cf9300768fea
SSDEEP 96:xHBUTUxVqGq5fg9o1zS/1SSlWdv9jmnqH/8MBw88n8L4cn+wGC:HyR5fg9o61SSudBw88hC
TLSH
T1CFE131789408CB7F75B676ACAC688C715AB2413B77BF68C710B65484051CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\prefs.js
Size 6KB
SHA256 d2d2b4fa3fc53eba5e3f3975429812693cdf32482c0f1047b854cc2fd6326265
MD5 07990b013030c3449965cdeb5a370b40
SHA1 a2216fdef77b0fce8b65eaf89e3f8328264f727d
SHA512 6eded46433eaa646a0e7d30a19490f7120919b1295c8236d8d7ee4ab7528fd2da65a8f318df6000e1fa2a491af719c0a13cf1e5c3d5c97ca883c5be76dc3407d
SSDEEP 96:xHBUTUxVqGq5fgIX1zSVtSSlWdv9jFnqH/8MBw88n8L4cn+wGC:HyR5fgIXYtSSldBw88hC
TLSH
T18CE110789518CB7F64B676BCAC648D315AB2013B77BF28C610B65484050CF3841F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\prefs.js
Size 6KB
SHA256 2334c38eb4226c13dd0b402cc4cfbc0e64485cb6f47e5b1eda3358dcc97e5cb3
MD5 99e1d0e35d3bbf715aa2a3355ad353f5
SHA1 6ccbce4db2731b06dc8870a520365882c35cf94b
SHA512 43ddb72262f46c3dc6433c90e8f39ba493ffa10ee79baf7aeb337137e90a168b87033bd482cec83ad4cf3982bffae0196f5b8ca808f83e066e096f789d2289dd
SSDEEP 96:xHBUTUxVqGq5fg9o1zSVtSSlWdv9jmnqH/8MBw88n8L4cn+wGC:HyR5fg9oYtSSudBw88hC
TLSH
T17CE120789418CB7F74B676ACAC688C315AB2413B77BF28C710BA5484051CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\sessionCheckpoints.json
Size 259B
SHA256 50a670fb78ff2712aae2c16d9499e01c15fddf24e229330d02a69b0527a38092
MD5 e6c20f53d6714067f2b49d0e9ba8030e
SHA1 f516dc1084cdd8302b3e7f7167b905e603b6f04f
SHA512 462415b8295c1cdcac0a7cb16bb8a027ef36ae2ce0b061071074ac3209332a7eae71de843af4b96bbbd6158ca8fd5c18147bf9a79b8a7768a9a35edce8b784bf
TLSH
T18ED02E83C209507ACE836E68B39CBB508E3F00F372240202B2AC888C183F023418F803
MD5 SHA1 SHA512 TLSH

Submit Download

nvml.dll

Path C:\Users\Admin\Downloads\nvml.dll
Size 327KB
SHA256 436e791e379f21c0dc55597e739466158cd343fab9da528d1b5b586518268cd7
MD5 cfa9492129a8b3e4e859097de41f6d58
SHA1 2373c7d4df16cb28bb626f8d52ab3887690ed08a
SHA512 612f32aeb4fa0c85139ed3d31181bcc7943cd825b51c6f87e8cf3a335b1a7e77e8b2f76cfff1c2111402d409f97299b165edc00f8d4d2bd6a8990f647964c409
SSDEEP 6144:p3n7CamhS+OKnkh2TKVu7Hy6iZl2jP/PMDvqmbKHszHev3wwUut9tlbqqqG:FCPYSkEuZlyjMD17H03wbuHx
TLSH
T1CF647C50B251FEB5DC8A8FB421E22349D3E6B041971DB93F6A20FF3C025EA68D573A45
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1296-0-0x00007FFE590D0000-0x00007FFE59111000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads