c0065563c6c85946730ef077b9fb3820cfe59e19f50eee259a60647a56fcb6f3

Analysis

max time kernel
150s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
11-06-2024 06:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

n.exe
Size

4.7MB
MD5

79ffc0a288862e26114769a9cd736bf5
SHA1

1434ad3050d1204987161d271c52448635bbf833
SHA256

c0065563c6c85946730ef077b9fb3820cfe59e19f50eee259a60647a56fcb6f3
SHA512

a404d4b459703b5b935e2231a2223bc89a94f1438f365335c634ba97b82bdb9c292875673903415c7d0979514d8868ec1a418fd021709dfffb5928b78bfc0c80
SSDEEP

98304:nOWLgD7YVuw0r50diU2Ea6UibMs7IqqCr4BK24G+:/8suj0dJa0AsnqC0l

Score

9^/10

bootkit evasion persistence trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	n.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 3 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	n.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	n.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	n.exe

Executes dropped EXE 1 IoCs

pid	Process
1820	Mabezat.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	n.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com
4	raw.githubusercontent.com
55	raw.githubusercontent.com
56	raw.githubusercontent.com
57	raw.githubusercontent.com
2	raw.githubusercontent.com

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	n.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3504	n.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2551177587-3778486488-1329702901-1000_Classes\Local Settings	firefox.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\Mabezat.exe:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3504	n.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	3504	n.exe
Token: SeDebugPrivilege	5096	firefox.exe
Token: SeDebugPrivilege	5096	firefox.exe
Token: SeDebugPrivilege	5096	firefox.exe
Token: SeDebugPrivilege	5096	firefox.exe
Token: SeDebugPrivilege	5096	firefox.exe

Suspicious use of FindShellTrayWindow 12 IoCs

pid	Process
5096	firefox.exe
5096	firefox.exe
5096	firefox.exe
5096	firefox.exe
5096	firefox.exe
5096	firefox.exe
5096	firefox.exe
5096	firefox.exe
5096	firefox.exe
5096	firefox.exe
5096	firefox.exe
5096	firefox.exe

Suspicious use of SendNotifyMessage 11 IoCs

pid	Process
5096	firefox.exe
5096	firefox.exe
5096	firefox.exe
5096	firefox.exe
5096	firefox.exe
5096	firefox.exe
5096	firefox.exe
5096	firefox.exe
5096	firefox.exe
5096	firefox.exe
5096	firefox.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
5096	firefox.exe
5096	firefox.exe
5096	firefox.exe
5096	firefox.exe
5096	firefox.exe
5096	firefox.exe
5096	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 744 wrote to memory of 5096	744	firefox.exe	81
PID 744 wrote to memory of 5096	744	firefox.exe	81
PID 744 wrote to memory of 5096	744	firefox.exe	81
PID 744 wrote to memory of 5096	744	firefox.exe	81
PID 744 wrote to memory of 5096	744	firefox.exe	81
PID 744 wrote to memory of 5096	744	firefox.exe	81
PID 744 wrote to memory of 5096	744	firefox.exe	81
PID 744 wrote to memory of 5096	744	firefox.exe	81
PID 744 wrote to memory of 5096	744	firefox.exe	81
PID 744 wrote to memory of 5096	744	firefox.exe	81
PID 744 wrote to memory of 5096	744	firefox.exe	81
PID 5096 wrote to memory of 404	5096	firefox.exe	82
PID 5096 wrote to memory of 404	5096	firefox.exe	82
PID 5096 wrote to memory of 404	5096	firefox.exe	82
PID 5096 wrote to memory of 404	5096	firefox.exe	82
PID 5096 wrote to memory of 404	5096	firefox.exe	82
PID 5096 wrote to memory of 404	5096	firefox.exe	82
PID 5096 wrote to memory of 404	5096	firefox.exe	82
PID 5096 wrote to memory of 404	5096	firefox.exe	82
PID 5096 wrote to memory of 404	5096	firefox.exe	82
PID 5096 wrote to memory of 404	5096	firefox.exe	82
PID 5096 wrote to memory of 404	5096	firefox.exe	82
PID 5096 wrote to memory of 404	5096	firefox.exe	82
PID 5096 wrote to memory of 404	5096	firefox.exe	82
PID 5096 wrote to memory of 404	5096	firefox.exe	82
PID 5096 wrote to memory of 404	5096	firefox.exe	82
PID 5096 wrote to memory of 404	5096	firefox.exe	82
PID 5096 wrote to memory of 404	5096	firefox.exe	82
PID 5096 wrote to memory of 404	5096	firefox.exe	82
PID 5096 wrote to memory of 404	5096	firefox.exe	82
PID 5096 wrote to memory of 404	5096	firefox.exe	82
PID 5096 wrote to memory of 404	5096	firefox.exe	82
PID 5096 wrote to memory of 404	5096	firefox.exe	82
PID 5096 wrote to memory of 404	5096	firefox.exe	82
PID 5096 wrote to memory of 404	5096	firefox.exe	82
PID 5096 wrote to memory of 404	5096	firefox.exe	82
PID 5096 wrote to memory of 404	5096	firefox.exe	82
PID 5096 wrote to memory of 404	5096	firefox.exe	82
PID 5096 wrote to memory of 404	5096	firefox.exe	82
PID 5096 wrote to memory of 404	5096	firefox.exe	82
PID 5096 wrote to memory of 404	5096	firefox.exe	82
PID 5096 wrote to memory of 404	5096	firefox.exe	82
PID 5096 wrote to memory of 404	5096	firefox.exe	82
PID 5096 wrote to memory of 404	5096	firefox.exe	82
PID 5096 wrote to memory of 404	5096	firefox.exe	82
PID 5096 wrote to memory of 404	5096	firefox.exe	82
PID 5096 wrote to memory of 404	5096	firefox.exe	82
PID 5096 wrote to memory of 404	5096	firefox.exe	82
PID 5096 wrote to memory of 404	5096	firefox.exe	82
PID 5096 wrote to memory of 404	5096	firefox.exe	82
PID 5096 wrote to memory of 404	5096	firefox.exe	82
PID 5096 wrote to memory of 404	5096	firefox.exe	82
PID 5096 wrote to memory of 404	5096	firefox.exe	82
PID 5096 wrote to memory of 404	5096	firefox.exe	82
PID 5096 wrote to memory of 1624	5096	firefox.exe	83
PID 5096 wrote to memory of 1624	5096	firefox.exe	83
PID 5096 wrote to memory of 1624	5096	firefox.exe	83
PID 5096 wrote to memory of 1624	5096	firefox.exe	83
PID 5096 wrote to memory of 1624	5096	firefox.exe	83
PID 5096 wrote to memory of 1624	5096	firefox.exe	83
PID 5096 wrote to memory of 1624	5096	firefox.exe	83
PID 5096 wrote to memory of 1624	5096	firefox.exe	83
PID 5096 wrote to memory of 1624	5096	firefox.exe	83
PID 5096 wrote to memory of 1624	5096	firefox.exe	83

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\n.exe
"C:\Users\Admin\AppData\Local\Temp\n.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3504

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:744
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5096
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5096.0.656987672\228943071" -parentBuildID 20230214051806 -prefsHandle 1788 -prefMapHandle 1780 -prefsLen 22074 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {82c37e8d-a4c7-4333-ae37-ac980686ece0} 5096 "\\.\pipe\gecko-crash-server-pipe.5096" 1880 25d1630aa58 gpu
    3⤵
    PID:404
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5096.1.1931059811\519730521" -parentBuildID 20230214051806 -prefsHandle 2392 -prefMapHandle 2388 -prefsLen 22110 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4972e336-040f-45a7-99d4-db670cf741c9} 5096 "\\.\pipe\gecko-crash-server-pipe.5096" 2404 25d0968a258 socket
    3⤵
    PID:1624
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5096.2.853237924\599522110" -childID 1 -isForBrowser -prefsHandle 2612 -prefMapHandle 2752 -prefsLen 22148 -prefMapSize 235121 -jsInitHandle 1352 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {afaff8f2-6175-4dc7-a243-583ed77a01e6} 5096 "\\.\pipe\gecko-crash-server-pipe.5096" 2708 25d190f2258 tab
    3⤵
    PID:3080
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5096.3.2105837422\399343790" -childID 2 -isForBrowser -prefsHandle 3560 -prefMapHandle 3556 -prefsLen 27614 -prefMapSize 235121 -jsInitHandle 1352 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {24a09ed7-567f-4f0b-8e71-eb8f5b821edb} 5096 "\\.\pipe\gecko-crash-server-pipe.5096" 3572 25d1bd22b58 tab
    3⤵
    PID:1960
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5096.4.1529785770\638050244" -childID 3 -isForBrowser -prefsHandle 5132 -prefMapHandle 5128 -prefsLen 27690 -prefMapSize 235121 -jsInitHandle 1352 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {eec1f7be-25a6-4a7b-9986-a1be10a30e38} 5096 "\\.\pipe\gecko-crash-server-pipe.5096" 5140 25d1e956f58 tab
    3⤵
    PID:1940
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5096.5.1052575240\1531802188" -childID 4 -isForBrowser -prefsHandle 5276 -prefMapHandle 5280 -prefsLen 27690 -prefMapSize 235121 -jsInitHandle 1352 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {aaadaa94-7b26-45d3-b852-c7bc2e4b7fc5} 5096 "\\.\pipe\gecko-crash-server-pipe.5096" 5268 25d1e956358 tab
    3⤵
    PID:1720
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5096.6.892529669\1864550300" -childID 5 -isForBrowser -prefsHandle 5484 -prefMapHandle 5488 -prefsLen 27690 -prefMapSize 235121 -jsInitHandle 1352 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3f31d611-014d-4238-b597-9bb78c585817} 5096 "\\.\pipe\gecko-crash-server-pipe.5096" 5160 25d1e955458 tab
    3⤵
    PID:3056
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5096.7.1343774340\251526336" -childID 6 -isForBrowser -prefsHandle 5936 -prefMapHandle 5932 -prefsLen 27774 -prefMapSize 235121 -jsInitHandle 1352 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f7f60032-1d28-4cd5-b02b-2af81ec1e82f} 5096 "\\.\pipe\gecko-crash-server-pipe.5096" 5912 25d1ffd0258 tab
    3⤵
    PID:4340
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5096.8.1100116297\2065881725" -childID 7 -isForBrowser -prefsHandle 3832 -prefMapHandle 5192 -prefsLen 28039 -prefMapSize 235121 -jsInitHandle 1352 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b39bca9a-dec9-4efe-8f55-a5d6c33c4756} 5096 "\\.\pipe\gecko-crash-server-pipe.5096" 5180 25d1d1ef258 tab
    3⤵
    PID:1688
- - C:\Users\Admin\Downloads\Mabezat.exe
    "C:\Users\Admin\Downloads\Mabezat.exe"
    3⤵
    - Executes dropped EXE
    PID:1820
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5096.9.349883208\1048449730" -childID 8 -isForBrowser -prefsHandle 6684 -prefMapHandle 5164 -prefsLen 28271 -prefMapSize 235121 -jsInitHandle 1352 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0cd23db0-4cb9-4fab-be4c-a261d0b9fd06} 5096 "\\.\pipe\gecko-crash-server-pipe.5096" 6676 25d1ab52058 tab
    3⤵
    PID:4188
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5096.10.50816787\1425333403" -childID 9 -isForBrowser -prefsHandle 10688 -prefMapHandle 10788 -prefsLen 28271 -prefMapSize 235121 -jsInitHandle 1352 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {534f7471-fab0-411f-b437-93b6d51bad88} 5096 "\\.\pipe\gecko-crash-server-pipe.5096" 10740 25d20ca3658 tab
    3⤵
    PID:2820
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5096.11.625136830\1976574886" -childID 10 -isForBrowser -prefsHandle 10688 -prefMapHandle 10564 -prefsLen 28271 -prefMapSize 235121 -jsInitHandle 1352 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d0881b01-2543-4011-9780-dccc3d2deba7} 5096 "\\.\pipe\gecko-crash-server-pipe.5096" 10464 25d22068958 tab
    3⤵
    PID:4744
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5096.12.1778010903\1314792213" -childID 11 -isForBrowser -prefsHandle 10292 -prefMapHandle 10288 -prefsLen 28271 -prefMapSize 235121 -jsInitHandle 1352 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6c5a09fc-4d3b-4b70-b6e2-24de784c438c} 5096 "\\.\pipe\gecko-crash-server-pipe.5096" 10272 25d2298eb58 tab
    3⤵
    PID:4280
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5096.13.487915260\1972157776" -childID 12 -isForBrowser -prefsHandle 10204 -prefMapHandle 10056 -prefsLen 28271 -prefMapSize 235121 -jsInitHandle 1352 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {41b69be0-ccd8-4d32-8b74-f567dd004a81} 5096 "\\.\pipe\gecko-crash-server-pipe.5096" 10272 25d16bd0558 tab
    3⤵
    PID:3388
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5096.14.786627822\960881497" -childID 13 -isForBrowser -prefsHandle 9880 -prefMapHandle 9876 -prefsLen 28271 -prefMapSize 235121 -jsInitHandle 1352 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {745884a8-3ae9-4659-853e-bd6e60cc15e4} 5096 "\\.\pipe\gecko-crash-server-pipe.5096" 9728 25d22c15458 tab
    3⤵
    PID:5184
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5096.15.682534721\488135246" -childID 14 -isForBrowser -prefsHandle 9744 -prefMapHandle 9748 -prefsLen 28271 -prefMapSize 235121 -jsInitHandle 1352 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7803e7f3-69f3-4769-bcee-4bec6c03242e} 5096 "\\.\pipe\gecko-crash-server-pipe.5096" 9896 25d22c17258 tab
    3⤵
    PID:5192
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5096.16.946592638\1667685155" -childID 15 -isForBrowser -prefsHandle 9404 -prefMapHandle 9460 -prefsLen 28271 -prefMapSize 235121 -jsInitHandle 1352 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c3a7634e-2e9d-4ce2-9221-a79822ec64ef} 5096 "\\.\pipe\gecko-crash-server-pipe.5096" 9880 25d22d35258 tab
    3⤵
    PID:5220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\prbn7a8y.default-release\activity-stream.discovery_stream.json.tmp

Filesize
22KB

MD5
82b58f02adfc7a255db08c56830f6a09

SHA1
6d004fc9098c45922a369281fbafbaddad7b3386

SHA256
9d4b4bc0455bd0d6648d1c1095d507dfada899f7ad324b154b5f08d8531a71c6

SHA512
9903c41261ae3a0b03a9a2663c3fcc95b692ad70619780ed8743eda926fbf81e709d4850bd9b089c46bfc460313680bf8f01a06e91f3d970236994077bdbd106

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\prbn7a8y.default-release\cache2\doomed\11611

Filesize
12KB

MD5
927c4dbe006318bf809a203d929641cc

SHA1
8f90af78e31be5378afb50dff2e209a416d229d2

SHA256
f1ce35116c648b1f5a003d84ed1b6984f37830b4181b77c48a1778f34ce421f8

SHA512
575cad3f0e1e287e915f40ef4d3a090102f348166138cae1e22730c99504d189cc89b65646013618a90e54d5aafb27b8641ce2dada9f0519d273f1649829626b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\prbn7a8y.default-release\cache2\doomed\16718

Filesize
9KB

MD5
e3c949d8c0c107cfd924585c3b73369f

SHA1
530ebb1e96110c6a0ceb6bc9a24e9c570a35d55e

SHA256
699c572701324df621a2a8d1cd7c2ee0137a468aec579e2690471a3d2deed352

SHA512
27f938ab1cf94d3600e88d87c5f8f7a86fd7bac121d20ca715d84e0be72c6f6d21ca254cd46b2128a0b28d40ef4ef1a5a02ef5e685e30cb635849bafa0731e00

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\prbn7a8y.default-release\cache2\doomed\26539

Filesize
16KB

MD5
a97ec6951c74be8215837a2d218acdc3

SHA1
a7651e04d06052e6305531299dddcf56dfa6d059

SHA256
c06e8bd7a2baa3ee0c681bfaff255514672537bc29325f7da53a821e79cd356b

SHA512
1dd124537c29b828e4d68f3edb133e74da97e72ba2947a3e35fa5e6719885074da9de878495d3e95fcf8b2b2c87fedd366bad5bb14dd5dfec7fb1e20adf0da06

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\prbn7a8y.default-release\cache2\doomed\29676

Filesize
16KB

MD5
5e2682645403787e5b0917bf7f8c8a52

SHA1
2786d1694b4dca256a54556f3a1d29aed1d7082b

SHA256
66076f99d14a639e0666373fac56280885759abe42624c0a15e6f171744f0303

SHA512
900dbaa6014411375595aac4b3febfe4721b5e8443854077f051629eb3db6b66d30cbd6e971e15544f8c751d782a6b6a498b7f121a4c15b3ad0bce4c7ce12109

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\prbn7a8y.default-release\cache2\doomed\31092

Filesize
12KB

MD5
4c4d4cb278d4abbdaba8384afd46525c

SHA1
a82a0fef75e1bbe58793b132ea625cd4be5d02eb

SHA256
06f835c0ba376effe93f0d52602dbb9606f71414d959a63cd2990ccff3b0fb53

SHA512
b294d3a6402b108201a094b5ed4012fe46051a49ed4f935f0deeb01fcd5eb814e4e48e4f525cb43558fa0984b46aaa0a41640602e3247b798fe613d3e2abf913

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\prbn7a8y.default-release\cache2\doomed\4063

Filesize
16KB

MD5
38b4813ce187f0e833e1205da6bd19ff

SHA1
6f8bb60feeeb0aee63267fe44e1517405e47c60a

SHA256
cc7b2a76ac1659841807223cd56c353d13389e5f5195c9f6c8fb37dd369a219f

SHA512
eb894d0567848f6c268c96887c8c58faf57a4af3fc170e4d9e9f81e76823ad058c71b38f68dc31b136290d5a988e416ab6c9d489f595919db4ea5219963c3b4b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\prbn7a8y.default-release\cache2\doomed\7424

Filesize
16KB

MD5
e53837af5e3a1be03fc2b4d970147d56

SHA1
ea46aa9563bad1ae0b8afefd9bdae2442c1c0b76

SHA256
4bc7c788f148968c336480d517af065b8462bff1a7dbe5a8adddb3d2f0769ffa

SHA512
e644fa935e87415c0c016b58d9efa2fe643545e5c1b26874b1f8916d5c850fe6cee3abd426532c4f637f2526417b850823c8fe861a129f872c6d20496fc4206e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\prbn7a8y.default-release\cache2\entries\7DEABB98080B97238B6EDD3960FC69AF88DF65F4

Filesize
60KB

MD5
2e469083f4afa9ee02a7a74780817776

SHA1
28964a13135694932292e69cce2bf692821272f8

SHA256
553c6b053441712673942a48f348a7881de100c7f7c04dbf1a549db984eff968

SHA512
92dcadcfda7c98a663da838d96e143e764e7faf3a6faa5c85ca5780092a9ba5dd8d079037ab7cda3370440f73807f20cddb41d42f730c8ac0940c37fa3d226cb

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\prbn7a8y.default-release\jumpListCache\ld4iLYaXnWeFrTB5IZHFRQ==.ico

Filesize
25KB

MD5
6b120367fa9e50d6f91f30601ee58bb3

SHA1
9a32726e2496f78ef54f91954836b31b9a0faa50

SHA256
92c62d192e956e966fd01a0c1f721d241b9b6f256b308a2be06187a7b925f9e0

SHA512
c8d55a2c10a2ef484dedded911b8f3c2f5ecb996be6f6f425c5bd4b4f53eb620a2baccd48bac1915a81da9a792971d95ff36c3f216075d93e5fd7a462ecd784f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\prbn7a8y.default-release\prefs-1.js

Filesize
6KB

MD5
7d7563b67a569a971a5f8ccc87ae6f1e

SHA1
0ef83f302053a7756d58d6f6f3cd1e78144eaa30

SHA256
7db44c6626a3a4d53d3d1cbb23ba5ff5b6ed09e15df56138d977f8d6b117e5df

SHA512
1238efbe962d21991218c536261dc890c876b4b6f710772060a17f7076713ede0435785d6239e5499c625bfcc1b03e0ba662fcfefba6f3745bcdad1c2dabe173

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\prbn7a8y.default-release\prefs-1.js

Filesize
7KB

MD5
72d03b365969ed90efa53733b422b4d9

SHA1
b44dfda8b5471b3dc5ef764992a7d03e668a0590

SHA256
afc6642afdf2a59909a384f5b924f19d64c29defebc43633e9d15762fbc956c7

SHA512
3d869badb4be6f26d966b31db4cd9a01e7c4c394781aab97349d4da4005ef6d4af87609d946a7210ff57759856e7fd374d91e8afe543ece402a4c9bf6de705f3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\prbn7a8y.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
fe8baa9ca9cf91de1e1f9476e769d8b6

SHA1
3f8291b841e88c77a01e1d3b759a50d63626c9ca

SHA256
b1a0172d8fd356ee8c60724ba00e6c75a638c0ddd976e0f99dc229980f5f2084

SHA512
e3bef1e2a0b3d0e8596457bbe694e91b96ffefe90fe2193ac08cc27f34f54adb6d247a5763a2f59da3b8aee1d6832e70155213cd16a22915a8d60b427950022a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\prbn7a8y.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
8KB

MD5
1daa2a6636ac2a5641fbc75733efc3f9

SHA1
f8d2b51a0261c839f59b4053123bc7d646acdde4

SHA256
9b81a749a14979f94a155db20d401e9c8a0e9be394137f60466661f9bf8bbffc

SHA512
c9e95a40e493285f6f29a38bd0de0be534d912525f42bb3e883ca23005370cfc6db482cc7164dc614ee4cdacc3f41a82b26461bdea71861a9a48febd15444ba1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\prbn7a8y.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
10KB

MD5
74ea621f0ce39b5ae9fd79917b3a6df3

SHA1
e146e39a2cd75e20175b4f2e1e6e68fcc1b5940c

SHA256
55a7aead19c49e6912dbe90ca4934e342af15d8d8d40aa47ae42da358f9e7620

SHA512
895e4998bf2936dae46fbef624947301a534742c10038e361eae02403800fe26fc09cf12e6fb8e21c5229d95e480fee075cff7723f9e16be6f4864fa82def43e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\prbn7a8y.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
12KB

MD5
7257d28b11965f6fde5cfb6054011d06

SHA1
725a5b6319ec025109cde99655875ca4a253d9a0

SHA256
b8116bad4c84044c873486f90c9e6efec72091ef48acc740af3a6ee142e8a8ca

SHA512
7d2b7c2a58b5c4a285715ff72ef177f33fdff6822c32597718fc98373c4b844a93b6d866e09c031c85b0fc19d14c9ad4e290a57955cc2f96380bd4dc781d1c0b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\prbn7a8y.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
c596ddafa8baa334056a8598176f2d08

SHA1
705ccb98b4db8bad10029d8c34af3e900a67bd62

SHA256
034edbd6f3c177a60ff6ec910ccf06d0b4b976d3cbc9ed615e58532244049de1

SHA512
dbfcc8bd339cce4f1759b6b9b143c3d99cd7911f58508cf1cb92f2d414b2d48c11c96061d493da76023fa822ee830d234c332fed97d14fda7a746ab7caeda495

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\prbn7a8y.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
2f20f82cfa8438dbd0769070f0528f25

SHA1
0801b3ba9c7603dc6cf5e8fb1fcaae29b8a1ebe0

SHA256
2a55f10655d3b035781918686ee0e990a0a7ddad803114aa4afec26c27739df6

SHA512
a2d6ff2295a72e6aa1cbbec838927afaed29cfe5a2780e544b26e39b4fc82dbad0ce30d78487f4f5e714b17bbc8150d9e5dd5d0f8bc8d84db485d23be4ebfa2f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\prbn7a8y.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
10KB

MD5
c1791a77b0bbf34c44d1656d5deec081

SHA1
d21260cfa42e5ecb760484811f07ff1f8a93e4a0

SHA256
e44ab00252a56f9992ffc6e10a601e418cf0a0da7fc469b7e0c8f2742f613af4

SHA512
c897efd266cae02d9c5f6e5ce0e61773bbc791389cfa7068fa895ef816cf51e1f9e9d4e84ca9e74d98af13d4d7408fdaf5516feed2760e281c1993eef55a761c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\prbn7a8y.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
11KB

MD5
dfd6601dfaeeb734af6121a846a5cee5

SHA1
4166d0d2e6440377e4a9117510cbff0826085735

SHA256
2be63f2aba96b686f6a1ef1696ee9a9050a3697b4c13e6668fb66f69a27a549e

SHA512
bf54b092f58da14b11f09fc1b8abbb42d04a8db05af2f1a61aa98be4a79ad1539b38c26356ec8601ad7201fb5d823ce893b8bd9fd73088cfcb333d745ea0d949

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\prbn7a8y.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
192KB

MD5
4b411dbf8a6db4b337ffd2641a2cc6b5

SHA1
05d4c1b12546b53d658bac57c96f3f1652524bdb

SHA256
ddbeb81a5e3be422022fa242b4318ebc56dd6b52d6cf458b0a0ee4c3d9ca833a

SHA512
a7b660512756c80c6b85d5db1dba5366ee1109b7cc555cd18408bd4dac3979e8482ec5e57f354852218ba0e5708dafb09ad8e65c13fa59f1d6fb9430583e15f2

Download Submit
C:\Users\Admin\Downloads\Mabezat.exe

Filesize
141KB

MD5
de8d08a3018dfe8fd04ed525d30bb612

SHA1
a65d97c20e777d04fb4f3c465b82e8c456edba24

SHA256
2ae0c4a5f1fedf964e2f8a486bf0ee5d1816aac30c889458a9ac113d13b50ceb

SHA512
cc4bbf71024732addda3a30a511ce33ce41cbed2d507dfc7391e8367ddf9a5c4906a57bf8310e3f6535646f6d365835c7e49b95584d1114faf2738dcb1eb451a

Download Submit
C:\Users\Admin\Downloads\Mabezat.exe:Zone.Identifier

Filesize
224B

MD5
c2d7ba75d5e579cf758ac98cf3eea161

SHA1
83cb3eea79040fa0bd0008d4aaf61a30a9858cd7

SHA256
087f1b476304a2c3921c2f4cf9859f878f193963c37315d8fae9e34c12e7a4bb

SHA512
512945daf82e3cb2f1ca80e87b35257a276783a589c704f305b77bab979778a958d18a71e4ad8592e58dbffffbcc82beb59a1afdf34a0c72a3a61a7a8f67574f

Download Submit
C:\Users\Admin\Downloads\Mabezat.jLP0O_NT.exe.part

Filesize
79KB

MD5
d36d91cc3f556f1afe726e5dc620f583

SHA1
ed35d02b705c09ae08b79555025c8fd043d5d5b5

SHA256
5a74149dd4d915ff3558d0dc86d5475eaf7596677bdfde8a10083d4ae9609a2c

SHA512
95a7b982bcb4bb0767aec58273e396eddd327c93d83e65f8ce19694492226e7ceeb4359842ad18c72dcfff770605ef3a7102e193d911f2adcb6c5159b1f856bc

Download Submit
memory/1820-665-0x0000000001000000-0x0000000001026000-memory.dmp

Filesize
152KB

Download
memory/1820-663-0x0000000001000000-0x0000000001026000-memory.dmp

Filesize
152KB

Download
memory/3504-11-0x0000000002E50000-0x0000000002E62000-memory.dmp

Filesize
72KB

Download
memory/3504-2-0x00007FFE80030000-0x00007FFE80031000-memory.dmp

Filesize
4KB

Download
memory/3504-3-0x00007FFEC16E7000-0x00007FFEC16E9000-memory.dmp

Filesize
8KB

Download
memory/3504-16-0x00007FFEC1640000-0x00007FFEC1849000-memory.dmp

Filesize
2.0MB

Download
memory/3504-10-0x00007FFEC1640000-0x00007FFEC1849000-memory.dmp

Filesize
2.0MB

Download
memory/3504-7-0x00007FFEC1640000-0x00007FFEC1849000-memory.dmp

Filesize
2.0MB

Download
memory/3504-8-0x0000000000400000-0x000000000105E000-memory.dmp

Filesize
12.4MB

Download
memory/3504-9-0x0000000000400000-0x000000000105E000-memory.dmp

Filesize
12.4MB

Download
memory/3504-0-0x0000000000400000-0x000000000105E000-memory.dmp

Filesize
12.4MB

Download
memory/3504-1-0x00007FFE80000000-0x00007FFE80002000-memory.dmp

Filesize
8KB

Download
memory/3504-15-0x0000000000400000-0x000000000105E000-memory.dmp

Filesize
12.4MB

Download
memory/3504-12-0x0000000002EC0000-0x0000000002EDA000-memory.dmp

Filesize
104KB

Download