436e791e379f21c0dc55597e739466158cd343fab9da528d1b5b586518268cd7

Resubmissions

08/07/2026, 09:38

260708-ll6neady6z10

08/07/2026, 09:37

260708-llngtsey6r5

08/07/2026, 07:19

260708-h5pbpadt2k5

Analysis

user interaction
yes
max time kernel
136s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 07:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
nvml.dll
Size 327KB
Sample260708-h5pbpadt2k
SHA256 436e791e379f21c0dc55597e739466158cd343fab9da528d1b5b586518268cd7
MD5 cfa9492129a8b3e4e859097de41f6d58
SHA1 2373c7d4df16cb28bb626f8d52ab3887690ed08a
SHA512 612f32aeb4fa0c85139ed3d31181bcc7943cd825b51c6f87e8cf3a335b1a7e77e8b2f76cfff1c2111402d409f97299b165edc00f8d4d2bd6a8990f647964c409
SSDEEP 6144:p3n7CamhS+OKnkh2TKVu7Hy6iZl2jP/PMDvqmbKHszHev3wwUut9tlbqqqG:FCPYSkEuZlyjMD17H03wbuHx
TLSH
T1CF647C50B251FEB5DC8A8FB421E22349D3E6B041971DB93F6A20FF3C025EA68D573A45
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

persistence ransomware

Malware Config

Signatures

Checks processor information in registry 2 TTPs 23 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	firefox.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
5816	NOTEPAD.EXE

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1452	firefox.exe
Token: SeDebugPrivilege	1452	firefox.exe
Token: SeDebugPrivilege	1452	firefox.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
1452	firefox.exe
1452	firefox.exe
1452	firefox.exe
1452	firefox.exe
1452	firefox.exe
1452	firefox.exe
1452	firefox.exe
1452	firefox.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4792	OpenWith.exe
1452	firefox.exe
1452	firefox.exe
1452	firefox.exe
1452	firefox.exe
5456	OpenWith.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 4792 wrote to memory of 2796	4792	OpenWith.exe	96
PID 2796 wrote to memory of 1452	2796	firefox.exe	97
PID 2796 wrote to memory of 1452	2796	firefox.exe	97
PID 1452 wrote to memory of 6080	1452	firefox.exe	98
PID 1452 wrote to memory of 6080	1452	firefox.exe	98
PID 1452 wrote to memory of 6080	1452	firefox.exe	98
PID 1452 wrote to memory of 1352	1452	firefox.exe	99
PID 1452 wrote to memory of 1352	1452	firefox.exe	99
PID 1452 wrote to memory of 1352	1452	firefox.exe	99
PID 1452 wrote to memory of 1352	1452	firefox.exe	99
PID 1452 wrote to memory of 2552	1452	firefox.exe	100
PID 1452 wrote to memory of 2552	1452	firefox.exe	100
PID 1452 wrote to memory of 2552	1452	firefox.exe	100
PID 1452 wrote to memory of 2552	1452	firefox.exe	100
PID 1452 wrote to memory of 4808	1452	firefox.exe	101
PID 1452 wrote to memory of 4808	1452	firefox.exe	101
PID 1452 wrote to memory of 4808	1452	firefox.exe	101
PID 1452 wrote to memory of 3744	1452	firefox.exe	102
PID 1452 wrote to memory of 3744	1452	firefox.exe	102
PID 1452 wrote to memory of 3744	1452	firefox.exe	102
PID 1452 wrote to memory of 3744	1452	firefox.exe	102
PID 1452 wrote to memory of 6104	1452	firefox.exe	103
PID 1452 wrote to memory of 6104	1452	firefox.exe	103
PID 1452 wrote to memory of 6104	1452	firefox.exe	103
PID 1452 wrote to memory of 6104	1452	firefox.exe	103
PID 1452 wrote to memory of 6408	1452	firefox.exe	104
PID 1452 wrote to memory of 6408	1452	firefox.exe	104
PID 1452 wrote to memory of 6408	1452	firefox.exe	104
PID 1452 wrote to memory of 6408	1452	firefox.exe	104
PID 1452 wrote to memory of 6428	1452	firefox.exe	105
PID 1452 wrote to memory of 6428	1452	firefox.exe	105
PID 1452 wrote to memory of 6428	1452	firefox.exe	105
PID 1452 wrote to memory of 6428	1452	firefox.exe	105
PID 1452 wrote to memory of 6440	1452	firefox.exe	106
PID 1452 wrote to memory of 6440	1452	firefox.exe	106
PID 1452 wrote to memory of 6440	1452	firefox.exe	106
PID 1452 wrote to memory of 6440	1452	firefox.exe	106
PID 5456 wrote to memory of 5816	5456	OpenWith.exe	108

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\nvml.dll,#1
1⤵
PID:3524

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3040

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4792
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\nvml.dll"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2796
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Local\Temp\nvml.dll
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1452
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1960 -prefsLen 27097 -prefMapHandle 1964 -prefMapSize 270279 -ipcHandle 1940 -initialChannelId {9032eb34-0622-491d-876b-bc91ab82dd3f} -parentPid 1452 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1452" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:6080
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2436 -prefsLen 27133 -prefMapHandle 2440 -prefMapSize 270279 -ipcHandle 2448 -initialChannelId {bdad5ca6-9450-4733-98fb-b4ab16e6bec0} -parentPid 1452 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1452" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      Checks processor information in registry
      PID:1352
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3684 -prefsLen 27274 -prefMapHandle 3688 -prefMapSize 270279 -jsInitHandle 3692 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3700 -initialChannelId {f2522fd3-7698-4939-b0a1-13e0ce3537a4} -parentPid 1452 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1452" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Checks processor information in registry
      PID:2552
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3852 -prefsLen 27274 -prefMapHandle 3856 -prefMapSize 270279 -ipcHandle 3728 -initialChannelId {f385af6e-68e2-4411-bb97-2e70252783f1} -parentPid 1452 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1452" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:4808
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2748 -prefsLen 34773 -prefMapHandle 2752 -prefMapSize 270279 -jsInitHandle 4312 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4324 -initialChannelId {d4540cf1-805a-4d72-adf5-4bc54d2dac06} -parentPid 1452 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1452" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      Checks processor information in registry
      PID:3744
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5192 -prefsLen 34928 -prefMapHandle 5196 -prefMapSize 270279 -ipcHandle 5004 -initialChannelId {191ce276-9d58-4283-a50a-b635ae01cd19} -parentPid 1452 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1452" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      Checks processor information in registry
      PID:6104
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5688 -prefsLen 32951 -prefMapHandle 5696 -prefMapSize 270279 -jsInitHandle 5684 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5704 -initialChannelId {dd6a4329-1448-4c4d-9f60-724f66a38da0} -parentPid 1452 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1452" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:6408
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5892 -prefsLen 32951 -prefMapHandle 5896 -prefMapSize 270279 -jsInitHandle 5900 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5908 -initialChannelId {2fd55158-3c38-4b25-b43e-ed6525b84662} -parentPid 1452 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1452" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:6428
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6076 -prefsLen 32951 -prefMapHandle 6080 -prefMapSize 270279 -jsInitHandle 6084 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6092 -initialChannelId {07b7cbb6-cd39-41a9-a01c-364901d491e4} -parentPid 1452 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1452" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      Checks processor information in registry
      PID:6440

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5456
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\nvml.dll
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:5816

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ke5ymhi.default-release\datareporting\glean\db\data.safe.tmp
Size 34KB
SHA256 369dd6da3022f7e79c0c8f8b8c244c2e1297c120ff880d3064275c62ae4aa605
MD5 5e69362d234da003e660dae7832c2e32
SHA1 bea3d0fb94ca614ac9d4c3f0871a4e914e05a820
SHA512 b0dde66c373e401e689da3cd97c5119575f2cd74f7ac66859b1e2bd1f46e9118662406e25dfa8bc6121d74c86c40fb7f8d4e26fa607b9957fd028c92b23307fe
SSDEEP 768:/lNVaO3aIJv6pGcm+urH3KP8H+5BimnymCbmbsb4bLbmbmbXb0bB1Pxtkw1/:zVaO3aIJvx3b1Pxtke
TLSH
T160F20144E71A913FD42812BBDCA507002F79F88A591A2FA73A5C646C6C872DC3D9E17F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ke5ymhi.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 dd202b7d23b546d66d95d724723fee693a958cb7001273ed62854351a0f8974c
MD5 80ad742a90c983e803eea807922fdab8
SHA1 b65a1d4b7d3c072f10eb83729d5cf94578958619
SHA512 4e00ac1e918938a45ad567ca70f54df8fadabb80bb423539c1957310ae5a6b86c6b1e1fee2f6089dc3339c0f210ad13dd2bb4fde3a6f7689f26606f1be747dc7
SSDEEP 192:bOv5zbo7zoZBCpyjW8MhcXY81d66JoztdzgCl6mc0dz:EboYZspyjtd66Joz/zgC1jd
TLSH
T17DE11FA8F629863FC418427BCCA60B414F76385B984E3F29359C650C2D572DE778E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ke5ymhi.default-release\datareporting\glean\events\events
Size 1KB
SHA256 c0e93aad84a84e6254f16a66bfbcb9ad0c5c6ba293f6042ea8e939c32f56ec89
MD5 6fb7556d01de337b38d11db765897a52
SHA1 d156ce0b59ca4d5d0afe2a1e9231bea3d79b6d88
SHA512 aca900c514dbb459509cef57f9b5d3addd86883bca9fe8f16d04bfbd3bf02faa6b6e54977ef030104c56010e5dc8646876aed384ecb8372bbbb0b75b337b2125
TLSH
T19C219E5C39F88D2A5DC7F65C7480038E93544E0704871C4B4E82EECDDED59ED326A839
MD5 SHA1 SHA512 TLSH

Submit Download

5f00dad8-5096-417c-9ffa-49e40f3cb0eb

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ke5ymhi.default-release\datareporting\glean\pending_pings\5f00dad8-5096-417c-9ffa-49e40f3cb0eb
Size 235B
SHA256 3fb09b6c36efb5e0a8f3e9373d13d5543856cfad6aac2ea63620d12dcec67a92
MD5 8702f9112957ffe5f3bc41e7ba3f1997
SHA1 75033e6e5bb37607e1e788d8fdef6f203b49f19c
SHA512 fdda3666a419f47b2ea4cc536eb0e8448afbdabf25e5a9305d30f32da11ed0c6362d993e2a4d29a822616a7df129cd79bc58caf23f90fee2e7722fb1ecda9441
TLSH
T190D097D124CC372C88200F1AF0A029D630854C3310A85C20CAA102749EFDAC801A292B
MD5 SHA1 SHA512 TLSH

Submit Download

8425fb8a-71a8-4483-a48e-4ec62adbf8f1

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ke5ymhi.default-release\datareporting\glean\pending_pings\8425fb8a-71a8-4483-a48e-4ec62adbf8f1
Size 2KB
SHA256 33e94719cdcf847b0080e51f6464a917787c34e9a97b5333cb11c9f9d0cf50c9
MD5 9d35909c2938ad3292829455acf4fcc4
SHA1 2903c8996c43707dfcb65e2f60306f1ae68e1ca1
SHA512 29c2ba427547396c6a0ce330c0315ba68b6a6d416c643eba21998bbe5908fe145077341e452089e15e03c81c78b5de8ec1091d4ed15058450d07003eaa36e473
TLSH
T13841629C35789D779C8EF29D9482378EC3618A0340C22C433D41EF0C8DA769E336A52B
MD5 SHA1 SHA512 TLSH

Submit Download

b7cdf20e-2cd7-45bf-90ed-f0b3455bb030

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ke5ymhi.default-release\datareporting\glean\pending_pings\b7cdf20e-2cd7-45bf-90ed-f0b3455bb030
Size 16KB
SHA256 9dfd645a47e65b21dcf6286f0121ff9753450a295650bc6fbd806e13267a7d23
MD5 ed78d6752e432bd1ffaf8bc00028fdb9
SHA1 ac538965aeaf9ec7cb2c54c03269e516fcb54958
SHA512 f6bd350335eb2662dc95dda32f316f9b89a0c2ea10c0b576ab8bd5d1e651b6c6fe572c12d7b905312e259244783107410310521d24842e7e32bbc6d0b9b938ad
SSDEEP 192:ZFQ4BRaE475mmzhedca+LO5ghOynQE/pxtGt82uXlBy11WxXj0bydDfrFaoIJJDE:zRi75mm9edcbho8T1QKXOydDfrFNSE
TLSH
T11E72EB46686059BA8651E36894FCBFC3E5F628CF4C019FCA9BE47D085DDE06E113784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

babff451-b64d-41c6-982d-fda23b70a38b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ke5ymhi.default-release\datareporting\glean\pending_pings\babff451-b64d-41c6-982d-fda23b70a38b
Size 235B
SHA256 d84e8e0df949bc5c8ed35e4f4c33d799a1927ba0586b8a00aa6233bd3bc120a3
MD5 3f6bcc6c41989626f5f5a9e99ed8ed2d
SHA1 a35b0ad6610f15c6f488fd9edd961dd3cda3efaf
SHA512 1e259952d938a5a39ff42287595199fcbb12a27d5e7996a2a592dc64b1d422c65dc1910cef7160a87946b70483b260e9b97d1ef49d13e91bb87298e143c77072
TLSH
T10FD09794249CB76D08040F1AF1E078D630898C3310A09850D6A148B4DAFAFE48122807
MD5 SHA1 SHA512 TLSH

Submit Download

dcda4514-88b5-46c7-93f2-de5900268214

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ke5ymhi.default-release\datareporting\glean\pending_pings\dcda4514-88b5-46c7-93f2-de5900268214
Size 883B
SHA256 6d0734b7eeb81fdc40f46692a9461de4ce7992ef46515e26f711d660eb53ec26
MD5 53cc611e04ff0fec549c601199a3e431
SHA1 ee21b60e14a5a024b0e2e67b5266acd63e01c29d
SHA512 e67816c1f07f77364f0be02ff91440c0143b71b32ac46628bb8fb5492889e6859f475c5afab2409f3961b6074cea82bc8cf0bf3fbc0e8ce3bf9016394056aa3f
TLSH
T1C111C481E235B672CC2CC24B85963B4287F5642380CB45143DE55E144DBE51BE3A678F
MD5 SHA1 SHA512 TLSH

Submit Download

ed1589d5-6c2c-4192-a5c8-867ab969f09f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ke5ymhi.default-release\datareporting\glean\pending_pings\ed1589d5-6c2c-4192-a5c8-867ab969f09f
Size 886B
SHA256 140cafa4c1b2dd55c813eb212701c844d73563b1b02127f873fb0599f123db67
MD5 0d1f524ecb474d24d2a7be2ead41ebd0
SHA1 952fa7fa1a11f55fc53111ff4ac131143ac8bf59
SHA512 d585fde5e3178b4cf8ea552d25f1bd91e87662d353d944ae54f8652c19213af9f3789bdee54dde499f658ea341fb5ba68c0ec5683100f8f281c4be6a30702d2b
TLSH
T19211C4809525B572CC69D29B88E57F03C7D4642380C709547DA45B084EFB51BA76778B
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ke5ymhi.default-release\prefs-1.js
Size 6KB
SHA256 1a8963c900c3c9ec44dd6b601c8b88f81d93f23a534698fb77f7772e663b590f
MD5 c7e4bac78f377d8514613344b0ac8e9b
SHA1 c00ed415c6e7a6a9df9af4601f49981c801988a0
SHA512 bc2dd58311ea0361dab1da9ea26d82cd1f5bd7d79c4363a6639487ba6598a0fbce1567ecb5f21f3ed4e3e7581a611f635e784ab2600ca9f77839cfacaf903036
SSDEEP 96:xH0UTUJhPqGq9fw7O1zS6SSlYdv9jdNnXRHjlBw88u8L4cneq+w:qTCR9fw7OpSSEN95Bw88T
TLSH
T157E110789108CF7F64B676BC6C6888716AB2013B7BBF68C650B554C4051CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ke5ymhi.default-release\prefs.js
Size 6KB
SHA256 905e3dfe86203d31229270b2a3379672713ce021977a6132a228902d8f992d29
MD5 1044bc319df3220c21baaa1c2d23d7c9
SHA1 a5713304ef820ea303047c8eced3a9b8b38403d0
SHA512 165950d03d0a89cc5694e061403093fc77a4a0460b7104ecdf24ef6d54846fbec8198e3217a98fcbe2681b6ece9fd7949a9b6f98acd0ce9e3f76861a6640627e
SSDEEP 96:xH0UTUJ+qGq9fwMWw1zSVW5oSSlYdv9jynXRHjlBw88u8L4cneR+w:qTR9fwM3OW5oSSH95Bw88m
TLSH
T1DBE121789108CB7F74B677AC6C688831AAB2013B7BBF68C650B954C5051CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nvml.dll

Path C:\Users\Admin\Downloads\nvml.dll
Size 327KB
SHA256 436e791e379f21c0dc55597e739466158cd343fab9da528d1b5b586518268cd7
MD5 cfa9492129a8b3e4e859097de41f6d58
SHA1 2373c7d4df16cb28bb626f8d52ab3887690ed08a
SHA512 612f32aeb4fa0c85139ed3d31181bcc7943cd825b51c6f87e8cf3a335b1a7e77e8b2f76cfff1c2111402d409f97299b165edc00f8d4d2bd6a8990f647964c409
SSDEEP 6144:p3n7CamhS+OKnkh2TKVu7Hy6iZl2jP/PMDvqmbKHszHev3wwUut9tlbqqqG:FCPYSkEuZlyjMD17H03wbuHx
TLSH
T1CF647C50B251FEB5DC8A8FB421E22349D3E6B041971DB93F6A20FF3C025EA68D573A45
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3524-0-0x00007FFB0A230000-0x00007FFB0A271000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads