7327b3c0a11b6eadc3f285f362c11b230beebc52985de041e07e27322e10db15

Resubmissions

12/08/2026, 02:55

260812-dera5sxdqe7

12/08/2026, 01:33

260812-byvfsswfjc7

10/08/2026, 07:45

260810-jlw3vsdm3x5

Analysis

user interaction
yes
max time kernel
170s
max time network
175s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-ja
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-jalocale:ja-jpos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 07:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
nvml.dll
Size 9KB
Sample260810-jlw3vsdm3x
SHA256 7327b3c0a11b6eadc3f285f362c11b230beebc52985de041e07e27322e10db15
MD5 8c69cbfd0f08553c9c6b0c6fc84825d8
SHA1 a802136a57b6d0fbc0d601a5f073352461769e4f
SHA512 843c97eb08632a885cacf15ed4ddfa0f84944b3fe6c2c18313b24e2469b7b2bbc62b598a9dd833602915e58b8e617199875d54085628e593a9d149017dd859a5
SSDEEP 192:WUuzoqZkOfQYl5+eDOFxKCAoakSVxFbdDl9:WNRQu52sVFpDl9
TLSH
T11212D735F35718EAE867EF3466D695327876B83806282E7E10D0EB3F3924DC4292C902
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

persistence ransomware

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 23 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	OpenWith.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
268	NOTEPAD.EXE

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3972	firefox.exe
Token: SeDebugPrivilege	3972	firefox.exe
Token: SeDebugPrivilege	3972	firefox.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
3972	firefox.exe
3972	firefox.exe
3972	firefox.exe
3972	firefox.exe
3972	firefox.exe
3972	firefox.exe
3972	firefox.exe
3972	firefox.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2636	OpenWith.exe
3972	firefox.exe
3972	firefox.exe
3972	firefox.exe
3972	firefox.exe
3540	OpenWith.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 2636 wrote to memory of 1460	2636	OpenWith.exe	97
PID 1460 wrote to memory of 3972	1460	firefox.exe	98
PID 1460 wrote to memory of 3972	1460	firefox.exe	98
PID 3972 wrote to memory of 3436	3972	firefox.exe	99
PID 3972 wrote to memory of 3436	3972	firefox.exe	99
PID 3972 wrote to memory of 3436	3972	firefox.exe	99
PID 3972 wrote to memory of 1612	3972	firefox.exe	100
PID 3972 wrote to memory of 1612	3972	firefox.exe	100
PID 3972 wrote to memory of 1612	3972	firefox.exe	100
PID 3972 wrote to memory of 1612	3972	firefox.exe	100
PID 3972 wrote to memory of 4668	3972	firefox.exe	101
PID 3972 wrote to memory of 4668	3972	firefox.exe	101
PID 3972 wrote to memory of 4668	3972	firefox.exe	101
PID 3972 wrote to memory of 4668	3972	firefox.exe	101
PID 3972 wrote to memory of 4956	3972	firefox.exe	102
PID 3972 wrote to memory of 4956	3972	firefox.exe	102
PID 3972 wrote to memory of 4956	3972	firefox.exe	102
PID 3972 wrote to memory of 3704	3972	firefox.exe	103
PID 3972 wrote to memory of 3704	3972	firefox.exe	103
PID 3972 wrote to memory of 3704	3972	firefox.exe	103
PID 3972 wrote to memory of 3704	3972	firefox.exe	103
PID 3972 wrote to memory of 6208	3972	firefox.exe	104
PID 3972 wrote to memory of 6208	3972	firefox.exe	104
PID 3972 wrote to memory of 6208	3972	firefox.exe	104
PID 3972 wrote to memory of 6208	3972	firefox.exe	104
PID 3972 wrote to memory of 6572	3972	firefox.exe	105
PID 3972 wrote to memory of 6572	3972	firefox.exe	105
PID 3972 wrote to memory of 6572	3972	firefox.exe	105
PID 3972 wrote to memory of 6572	3972	firefox.exe	105
PID 3972 wrote to memory of 6588	3972	firefox.exe	106
PID 3972 wrote to memory of 6588	3972	firefox.exe	106
PID 3972 wrote to memory of 6588	3972	firefox.exe	106
PID 3972 wrote to memory of 6588	3972	firefox.exe	106
PID 3972 wrote to memory of 6596	3972	firefox.exe	107
PID 3972 wrote to memory of 6596	3972	firefox.exe	107
PID 3972 wrote to memory of 6596	3972	firefox.exe	107
PID 3972 wrote to memory of 6596	3972	firefox.exe	107
PID 3540 wrote to memory of 268	3540	OpenWith.exe	109

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\nvml.dll,#1
1⤵
PID:2716

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1268

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2636
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\nvml.dll"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1460
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Local\Temp\nvml.dll
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3972
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1952 -prefsLen 27019 -prefMapHandle 1956 -prefMapSize 270249 -ipcHandle 2040 -initialChannelId {ebe77de4-18c3-4feb-9392-3375335f3c7c} -parentPid 3972 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3972" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:3436
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2440 -prefsLen 27055 -prefMapHandle 2444 -prefMapSize 270249 -ipcHandle 2452 -initialChannelId {8ee96254-1f42-4359-9bbc-8aafa22e0289} -parentPid 3972 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3972" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      Checks processor information in registry
      PID:1612
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3836 -prefsLen 27196 -prefMapHandle 3840 -prefMapSize 270249 -jsInitHandle 3844 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3852 -initialChannelId {a65867ab-1a3a-47dd-bd96-1ce967c17c26} -parentPid 3972 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3972" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Checks processor information in registry
      PID:4668
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4000 -prefsLen 27196 -prefMapHandle 4004 -prefMapSize 270249 -ipcHandle 4112 -initialChannelId {076e1e2f-7854-42f9-98ec-f128bbfca739} -parentPid 3972 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3972" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:4956
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4448 -prefsLen 34695 -prefMapHandle 4452 -prefMapSize 270249 -jsInitHandle 4456 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4464 -initialChannelId {d795b42f-93b2-472c-ace4-00e726c3fcc7} -parentPid 3972 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3972" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      Checks processor information in registry
      PID:3704
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5280 -prefsLen 34851 -prefMapHandle 5284 -prefMapSize 270249 -ipcHandle 5256 -initialChannelId {f0039212-cee7-4d88-807a-c1373363c757} -parentPid 3972 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3972" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      Checks processor information in registry
      PID:6208
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3024 -prefsLen 32809 -prefMapHandle 5176 -prefMapSize 270249 -jsInitHandle 5180 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5708 -initialChannelId {d40d887e-38d8-4296-be94-1bb7b7c74c4d} -parentPid 3972 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3972" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:6572
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5912 -prefsLen 32809 -prefMapHandle 5916 -prefMapSize 270249 -jsInitHandle 5920 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5928 -initialChannelId {5585f680-a2b2-4c4e-9de7-df9723796455} -parentPid 3972 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3972" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:6588
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5952 -prefsLen 32809 -prefMapHandle 5956 -prefMapSize 270249 -jsInitHandle 5960 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5968 -initialChannelId {25e1c114-dc1a-4489-a13d-d8563913653c} -parentPid 3972 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3972" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      Checks processor information in registry
      PID:6596

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3540
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\nvml.dll
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:268

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:4792

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 30779102aea37ad93fcd3237bc6f95e9bb69ff3f0412e25d4f3334c007c7b171
MD5 162772b6559640d141cd5e62d2695e5b
SHA1 b4f9a4bf71174472114f740fba2c88b893298836
SHA512 55f591145b63db3816c07f74d093da6b4ea6654e36416549baa9972c55248436261a2432a3a073f30ca77cacb622850129050446610961daf0938bc72af87b5b
SSDEEP 192:3H6Z1d66JoztdzgCl6mc0dUOv5zbo7GZJnyjL8:KXd66Joz/zgC1jlboCZJnyj
TLSH
T146E1FEA4EB29863FC418027BCCA61B414F39398B984E3F1535DC640C2D572DE7A8E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\events\events
Size 1KB
SHA256 bd5377f194e64750f4e8b0ea7918d998c719c272222cec69c27d19cf7df0c93c
MD5 e70902aa312a0ac782086055467a56a3
SHA1 15837c38cf5fd29b873eb4abe9cfff557ca9eee4
SHA512 4119cb494fb1261c8f7a8fee93e0f4808ad842df65282088854e233293e9d3a4f23764421fda511de681742abdf8414722b4da243457eee88134bbf3b4fa2f4f
TLSH
T11E212B5C3AB94D7E588AE6987850038EA7518E0A14C71D438E52EFCDDDD16DE326A438
MD5 SHA1 SHA512 TLSH

Submit Download

75a71437-6d48-43a2-bacc-52d32c03aaa1

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\75a71437-6d48-43a2-bacc-52d32c03aaa1
Size 886B
SHA256 e1645f84ba857872eec6c323882384644f8ae212b428bf07cb1203516ced5097
MD5 cbe24695155ced94166fa8a7b23ad8ab
SHA1 37a5ccb236b50dbdc4177509cbcf6d0491e2c20d
SHA512 2528d900e9599f52af47b557961861abe45dc21b504e459d4b0869be65a71271f65750becc1ec26e469eb1262951a15277ff047c8d69cff246682f274e0cc0fc
TLSH
T1B9110051CB7579B2CC28C28BC9E577528FA4752380C60A047E984B084DBA65EE7AB307
MD5 SHA1 SHA512 TLSH

Submit Download

b0d163a5-d7f7-41a1-9b36-db2a3497adb4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\b0d163a5-d7f7-41a1-9b36-db2a3497adb4
Size 235B
SHA256 0b47dc427093cc18c4e3b5e1235002a0488ebcd731438a42990a8493ae598cf2
MD5 120d655db64aff1e563299c2314b6cd3
SHA1 f1cdafefc85e14c6e7d19dba2ae2ba45acd50c63
SHA512 979ab0501e614c0862e5c5f2215daf1002e0ee4d756f3acac7d4109cad95f669631065875e521fbfe146878d9612194c3eeb60b2f5962662f3707ab7ae0dc12f
TLSH
T16BD09780349DA32C08051F03B0F228C231898C3369606C30C5A20079CEFDEC85312816
MD5 SHA1 SHA512 TLSH

Submit Download

bbd82d68-a88e-4cd6-b05b-c2cb1378a891

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\bbd82d68-a88e-4cd6-b05b-c2cb1378a891
Size 2KB
SHA256 358613fdefcc9b5fa12318e48729f6d6af07a91318555c6e2d332cb0789aadb5
MD5 07fe2ded4ad99d333387e80905fe77c2
SHA1 f68ef6757a951c0a86dab97424ee736d06bdd90f
SHA512 479e83de155d4042dc56eda61676799d97721cd84e383cc8aa3a0c3496ec4020a2071568ed11931e2974c77d10c1267e9866728f36f4cb2ba0c7142a9935ba53
TLSH
T17A41625875B84D769CD6F24DD49233CD9760AA0310C218832D41EF0CCDA6ADE63AF41B
MD5 SHA1 SHA512 TLSH

Submit Download

c7abfbd5-cc5c-4f78-a53e-c64801781e12

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\c7abfbd5-cc5c-4f78-a53e-c64801781e12
Size 16KB
SHA256 a9c5776f8fced46957bf1f354bdb3f5d5a94cf71f5278b40de59c1c49f88af9b
MD5 48e831a6a45c759eb4394f583d388876
SHA1 4a08700343b86d405713c83a6d0eef9da809386a
SHA512 8982c85799b985ab62df2011ee0b79b749c3598c44766f403c02640fb53929bca5e67dee8d9219e1c40c157a8ac228fc83898dc00ed7b98fb84f21ce02b5794c
SSDEEP 192:cPSGVsi5KkbzxRnEidXdcazSRhJfwNMcRxyQBAxg1+qYAlRr/IEuQ2Rn/YjEKtBV:crsi5KkblRTdXSaeRUMyxyQsPG9J
TLSH
T1B372EB56686056BE8551E3A8D4FC7FC3E2F528CF4C019FCA9BE0BD085DEA05E512784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dc9ffcbb-db00-46da-8804-d0f778efd93c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\dc9ffcbb-db00-46da-8804-d0f778efd93c
Size 235B
SHA256 e11d4abca0283cf1195102b1432961344aefa6b42b54b482a423825861cfa332
MD5 18cb8c14d3c05cb4be160329f701a7b2
SHA1 c866beb00be95d3f11d10ffc3db4debf42c53899
SHA512 f6e982ee6864803a637073d7e76937bd1c37ba1dfb9ee5b37c5354bdc2f55b5e6e361c5e401fbaabdbcf17e78edd93791b981ff708c3fa7f9f5bd3c8afc387ff
TLSH
T1BDD0978018A8672E48200F03F0A868C2308C4C3328649850D6A0417889FDDC8D121827
MD5 SHA1 SHA512 TLSH

Submit Download

f63971cc-3b6f-4bfc-adc6-9ab897205779

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\f63971cc-3b6f-4bfc-adc6-9ab897205779
Size 883B
SHA256 1c4f1571d7d5330bf86e662c259c9de6504104a77e02225ae1f7898e772cb8f8
MD5 8494da2fe5fc5ad072dd75c8155c3c58
SHA1 e8a4ef3f181206e806c718edc1e428fd82997e48
SHA512 a38b3d9401cd922b3ac30c117fb9d5421da6126be6239f1063a4b86360569b8f0d6cc43361996a32c2c57449ccf559126ca1b2afc5dbfc7aea1d2813a3c3c52e
TLSH
T120110C40D732BAA2CC38924BC9B977028FE8791380C746003DA55E084E7A65EA7AB647
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs-1.js
Size 6KB
SHA256 cc7fb847a17c25a92106ae577380cf1e633cf432497cfbd92d15fe5ccdda986f
MD5 4488ceba7b030091383b1487ebd44639
SHA1 20dd25dd404375e983aa7899046f4c80b833cc78
SHA512 112b08a5f107f63ab5dc5dd4a44d5de4d85d53d9f454854be528c338afe855be97d36668566d82a9898635f8922f33d6beac420f1cdb1b636713ee300da0ad19
SSDEEP 96:xHpUTUJPqGqPf2N1zS1SSlvdv9j3n+cHjCa/Bw88u8L4cnAVGb:v5CRPf2N8SSjj7/Bw88q2
TLSH
T1DAE1107894088F7F64B5767CAC688C31AAB2023B77BF28D750B95484015CF3841F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs.js
Size 6KB
SHA256 5b1160506aa72180e9d870488ad630f849cb50c371efc42270b6675c8b75f575
MD5 76cc582ee2f2d3e412ba7b5e62dc38fc
SHA1 b72d9218e224dc86df1ab0b0481e9f9ca75e2571
SHA512 0087a8ceacdd7bc3e0d2968aa8de2a6e2b16c328485fd44eff6b27ad8992561d01b6c3a248b0829cf9e10a9a30f9da196e8fc52f68656bc80fda78aef5ebc28b
SSDEEP 96:xHpUTUWqGqPf2N1zSNSSlvdv9jIn+cHjCa/Bw88u8L4cnAV7wb:vRRPf2NQSSQj7/Bw88qU
TLSH
T191E11F7894088B7F64B6776CAC648831AAB2413BBBBF28D750B95485014CF3842F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs.js
Size 6KB
SHA256 cb9b28ffa2f348a3a7d094a061224ea6695a39437bc4306b53b5f61a69725e87
MD5 365462030bdfdd9606718a80046a56ae
SHA1 98380c5163a84fe293931583b393a1d09d76b3a8
SHA512 caf79efcddfce57545470bcf9627716e3f2658e31801ef2e61f24e8b7270eb17a986531da389ad8a2d5737c95c58da0b56ad0058dfb8b87e060735abe5979144
SSDEEP 96:xHpUTUWqGqPf2N1zS1SSlvdv9jIn+cHjCa/Bw88u8L4cnAV7wb:vRRPf2N8SSQj7/Bw88qU
TLSH
T152E1107894088F7F64B5767CAC688831AAB2013B77BF28D750B95484014CF3842F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nvml.dll

Path C:\Users\Admin\Downloads\nvml.dll
Size 9KB
SHA256 7327b3c0a11b6eadc3f285f362c11b230beebc52985de041e07e27322e10db15
MD5 8c69cbfd0f08553c9c6b0c6fc84825d8
SHA1 a802136a57b6d0fbc0d601a5f073352461769e4f
SHA512 843c97eb08632a885cacf15ed4ddfa0f84944b3fe6c2c18313b24e2469b7b2bbc62b598a9dd833602915e58b8e617199875d54085628e593a9d149017dd859a5
SSDEEP 192:WUuzoqZkOfQYl5+eDOFxKCAoakSVxFbdDl9:WNRQu52sVFpDl9
TLSH
T11212D735F35718EAE867EF3466D695327876B83806282E7E10D0EB3F3924DC4292C902
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2716-0-0x00007FFAB9980000-0x00007FFAB9BE3000-memory.dmp

Download

memory/2716-1-0x00007FFAB11D0000-0x00007FFAB11D7000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads