87f65b253fd3379d9dde4524e0ebf4baceb282ec8f025d1765a69ae5c5695b7a

Resubmissions

25-08-2024 14:19

240825-rm6yfszfrr 7

Analysis

max time kernel
71s
max time network
73s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25-08-2024 14:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

BORATrat2024.exe
Size

9.9MB
MD5

6681923b59c01f862b7fb20182a3901b
SHA1

4242f33bd96d9a6ade283aeb6af6b49c80cfccc3
SHA256

87f65b253fd3379d9dde4524e0ebf4baceb282ec8f025d1765a69ae5c5695b7a
SHA512

8df3d0dd600e3e228ac60dfb7af1c7d161ae0268a2d1793a55f666a965cd39eaa6f355d60c50968771a45c1b4e2ce6960ffaee13b427d0986f77bd264807bd65
SSDEEP

196608:tAvmQOfJf/priQPhVBICX82UmZ1U/f5vboG++EVDjjglfkp8d7REM4NI:SO5JXhiQPn5Xj1OfVbboifkp8xU+

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4404	Bor@[email protected]
3524	BoratRat.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BORATrat2024.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Software\Microsoft\Internet Explorer\PhishingFilter	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = 65872a0712e5da01	iexplore.exe

Modifies Internet Explorer settings 1 TTPs 33 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Software\Microsoft\Internet Explorer\RepId	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4225555917"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31127290"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{21BDD239-62ED-11EF-A2A4-EEE1DD5A0987} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31127289"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31127290"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "4225555917"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "29808138"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "29808138"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\RepId\PublicId = "{1BA1AAAA-9225-461A-83D1-35F2F8AFF8A3}"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31127289"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings	iexplore.exe

Suspicious behavior: EnumeratesProcesses 29 IoCs

pid	Process
3524	BoratRat.exe
3524	BoratRat.exe
3524	BoratRat.exe
3524	BoratRat.exe
3524	BoratRat.exe
3524	BoratRat.exe
3524	BoratRat.exe
3524	BoratRat.exe
3524	BoratRat.exe
3524	BoratRat.exe
3524	BoratRat.exe
3524	BoratRat.exe
3524	BoratRat.exe
3524	BoratRat.exe
3524	BoratRat.exe
3524	BoratRat.exe
3524	BoratRat.exe
3524	BoratRat.exe
3524	BoratRat.exe
3524	BoratRat.exe
3524	BoratRat.exe
3524	BoratRat.exe
3524	BoratRat.exe
3524	BoratRat.exe
3524	BoratRat.exe
3524	BoratRat.exe
3524	BoratRat.exe
3524	BoratRat.exe
3524	BoratRat.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3708	OpenWith.exe
3524	BoratRat.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeRestorePrivilege	2032	7zG.exe
Token: 35	2032	7zG.exe
Token: SeSecurityPrivilege	2032	7zG.exe
Token: SeSecurityPrivilege	2032	7zG.exe
Token: SeDebugPrivilege	3524	BoratRat.exe

Suspicious use of FindShellTrayWindow 9 IoCs

pid	Process
2388	iexplore.exe
2388	iexplore.exe
2388	iexplore.exe
2388	iexplore.exe
2388	iexplore.exe
2388	iexplore.exe
2032	7zG.exe
3524	BoratRat.exe
3524	BoratRat.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
3524	BoratRat.exe
3524	BoratRat.exe

Suspicious use of SetWindowsHookEx 37 IoCs

pid	Process
3708	OpenWith.exe
3708	OpenWith.exe
3708	OpenWith.exe
3708	OpenWith.exe
3708	OpenWith.exe
3708	OpenWith.exe
3708	OpenWith.exe
3708	OpenWith.exe
3708	OpenWith.exe
3708	OpenWith.exe
3708	OpenWith.exe
3708	OpenWith.exe
3708	OpenWith.exe
3708	OpenWith.exe
3708	OpenWith.exe
3708	OpenWith.exe
3708	OpenWith.exe
3708	OpenWith.exe
3708	OpenWith.exe
3708	OpenWith.exe
3708	OpenWith.exe
3708	OpenWith.exe
3708	OpenWith.exe
3708	OpenWith.exe
3708	OpenWith.exe
2388	iexplore.exe
2388	iexplore.exe
848	IEXPLORE.EXE
848	IEXPLORE.EXE
2388	iexplore.exe
2388	iexplore.exe
1744	IEXPLORE.EXE
1744	IEXPLORE.EXE
2388	iexplore.exe
2388	iexplore.exe
2792	IEXPLORE.EXE
2792	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 4976 wrote to memory of 3112	4976	BORATrat2024.exe	107
PID 4976 wrote to memory of 3112	4976	BORATrat2024.exe	107
PID 3112 wrote to memory of 4404	3112	cmd.exe	108
PID 3112 wrote to memory of 4404	3112	cmd.exe	108
PID 3708 wrote to memory of 2388	3708	OpenWith.exe	110
PID 3708 wrote to memory of 2388	3708	OpenWith.exe	110
PID 2388 wrote to memory of 848	2388	iexplore.exe	112
PID 2388 wrote to memory of 848	2388	iexplore.exe	112
PID 2388 wrote to memory of 848	2388	iexplore.exe	112
PID 2388 wrote to memory of 1584	2388	iexplore.exe	114
PID 2388 wrote to memory of 1584	2388	iexplore.exe	114
PID 2388 wrote to memory of 1744	2388	iexplore.exe	115
PID 2388 wrote to memory of 1744	2388	iexplore.exe	115
PID 2388 wrote to memory of 1744	2388	iexplore.exe	115
PID 2388 wrote to memory of 4268	2388	iexplore.exe	116
PID 2388 wrote to memory of 4268	2388	iexplore.exe	116
PID 2388 wrote to memory of 2792	2388	iexplore.exe	117
PID 2388 wrote to memory of 2792	2388	iexplore.exe	117
PID 2388 wrote to memory of 2792	2388	iexplore.exe	117

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\BORATrat2024.exe
"C:\Users\Admin\AppData\Local\Temp\BORATrat2024.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4976
- C:\Windows\system32\cmd.exe
  "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\5946.tmp\5947.tmp\5948.bat C:\Users\Admin\AppData\Local\Temp\BORATrat2024.exe"
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3112
- - C:\Users\Admin\AppData\Local\Temp\5946.tmp\Bor@[email protected]
    Bor@[email protected]
    3⤵
    - Executes dropped EXE
    PID:4404

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3668,i,8548254608087149642,10333768245962368401,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:8
1⤵
PID:1792

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3708
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5946.tmp\Borat.rar
  2⤵
  - Modifies Internet Explorer Phishing Filter
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2388
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2388 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:848
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5946.tmp\Borat.rar
    3⤵
    - Modifies Internet Explorer settings
    PID:1584
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2388 CREDAT:82948 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:1744
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Downloads\Borat.rar
    3⤵
    - Modifies Internet Explorer settings
    PID:4268
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2388 CREDAT:17422 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2792

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1888

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Borat\" -spe -an -ai#7zMap1580:72:7zEvent4547
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2032

C:\Users\Admin\Downloads\Borat\BoratRat.exe
"C:\Users\Admin\Downloads\Borat\BoratRat.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3524

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:1140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\ver332C.tmp

Filesize
15KB

MD5
1a545d0052b581fbb2ab4c52133846bc

SHA1
62f3266a9b9925cd6d98658b92adec673cbe3dd3

SHA256
557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1

SHA512
bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

Download Submit
C:\Users\Admin\AppData\Local\Temp\5946.tmp\5947.tmp\5948.bat

Filesize
72B

MD5
8bfb34978fbae359cc7efbc8521eda2e

SHA1
e2d11f7061801e3a80a818277a60c2daad31680f

SHA256
fb8bc8c28c26af4df91f683e9a3a62e766e47940fd9eec6298ed9f621fbb7b65

SHA512
4fb11adc90cd7cd21453e62b26ac9468c5ccf0560e0804fb369c6e7c4834542902445e4b821ad2b1d96e0bbf0a72d5e4bcf3c384c5408b8de83a550a66e63ad4

Download Submit
C:\Users\Admin\AppData\Local\Temp\5946.tmp\Bor@[email protected]

Filesize
132KB

MD5
1004fd7892bd0410876232cc1d530d1a

SHA1
a2a14d41cdce5f4c447b6396f0fbd0fcec1859d3

SHA256
c5b49ca223899cf3e9b0360eb321afdc14b2806258d945893ed10f9a3843f32c

SHA512
bfaea4fe653b4becfb87131d1895c957f2d15da91c0291b5036a2b594528a1dfeac1ac4e6e31d4314b7ea262d63eaaf41265002a559ef08bd5469237f3fdce4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\5946.tmp\Borat.rar

Filesize
9.6MB

MD5
e3b10d235c365ac49d6855df0432bb76

SHA1
4ce182c19796cf8d4c017fdd8fd4b390de1eac7e

SHA256
53cdc49c7fb83b419c07edb45c544b106aaa37db00e8a37211678af6350a82f1

SHA512
bb91a4bf979516c2a19733772b4c34b09b45efbcec491f2fb62adde9222e6306ce32a17de3e6f9b3d7338a93f3d72e4747a23157675663f00e9f153bc4ec4704

Download Submit
C:\Users\Admin\Downloads\Borat\BoratRat.exe

Filesize
20.0MB

MD5
65b694d69d327efe28fcbce125401e96

SHA1
049d4d71742b99a598c074458f1f2d5b0119e912

SHA256
de60ecbbfef30c93fe8875ef69b358b20076d1f969fc3d21ab44d59dc9ef7cab

SHA512
7ab57642e414e134e851d9aa2ed3ef8b483f3a5f77877cdc04e08d7f95c44884f8ccc6beaf8ba7f6949cfd7398c46be46c024d4fdeacd3a332d4565609baad5b

Download Submit
C:\Users\Admin\Downloads\Borat\BoratRat.exe.config

Filesize
5KB

MD5
3e645ccca1c44a00210924a3b0780955

SHA1
5d8e8115489ac505c1d10fdd64e494e512dba793

SHA256
f29e697efd7c5ecb928c0310ea832325bf6518786c8e1585e1b85cdc8701602f

SHA512
ea7e3a6e476345870f05124a56dde266e1ad04b557b2dde83c5674cfdf3be00f26d3db6a14a8d88ecf75e2c9e3a12e6955f6c85654ba967c17664e9acc3d4f1f

Download Submit
C:\Users\Admin\Downloads\Borat\ServerCertificate.p12

Filesize
1KB

MD5
478ee44a47895e687296b9ab34df04c4

SHA1
4b81e94f3d3a99cc01d5c57bd5bec8317f0aca4f

SHA256
4b0612b2cd5e7ecc456d5c29c89917b8ec881c5f4fd94afe157098ca96308781

SHA512
28c0635f1e5062fcdef783aceaa8aa53531f18ce66d4aed62a99ec5b31a364e0d0d36fa237d978d75f51a859a7140d31e62aed340eae4aa769e02d1640e30c7b

Download Submit
memory/3524-98-0x0000025CD3E00000-0x0000025CD520A000-memory.dmp

Filesize
20.0MB

Download
memory/4404-13-0x00000000001C0000-0x00000000001E6000-memory.dmp

Filesize
152KB

Download
memory/4404-14-0x00007FFDBC8B3000-0x00007FFDBC8B5000-memory.dmp

Filesize
8KB

Download